Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    23/08/2024, 01:00

General

  • Target

    b9c00edf91b8e33cd85d47f799e5c013_JaffaCakes118.html

  • Size

    61KB

  • MD5

    b9c00edf91b8e33cd85d47f799e5c013

  • SHA1

    7381e95f2bc2142e8bbdfcda569f29d8e5eec7d5

  • SHA256

    f05329c148891eb5d745599cdbee0ea36c2cbed044cff60f2bf47b32869d7c22

  • SHA512

    97f066e244a819bc685880a2942af504d49e510c2a538693b34486d52e5a34bdb8ee7fbe6773803705c950d8e2014066cf76507e9f6a2fed209ae8343882c69e

  • SSDEEP

    1536:AtIu5zva9O3KkgeQV/oLXrQHtBBi9ByfM5x93HWsFtjnzak:A/zva9OakgeQV/oLXr+YoUt3HfFtjd

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b9c00edf91b8e33cd85d47f799e5c013_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3064 CREDAT:275457 /prefetch:2
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

    Filesize

    854B

    MD5

    e935bc5762068caf3e24a2683b1b8a88

    SHA1

    82b70eb774c0756837fe8d7acbfeec05ecbf5463

    SHA256

    a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

    SHA512

    bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    1KB

    MD5

    7c677c5ca92b057e471cff7a2a2f5e5a

    SHA1

    a11a1bcc4d03281ddeb14f160dcc3a8fc916ac56

    SHA256

    d2b61f9ccd693e853ec4f4322b2cf25e23e45625956c45444c409c9583517178

    SHA512

    eed9b1bfcdfa2f7a4bd97b83b3b77eeb6fd0999fad79c8d5982e0371af6c3e29e5835a1c2b059ffdbec7a77a461f4b925628bd0ae8d6e3a3f4fcf55dd1932e2d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_147AB4536A182B9FCE88E194D59F3B22

    Filesize

    471B

    MD5

    c647e7b34d1a1d4f892fe6316a872164

    SHA1

    b7412222c631b97797c1808b442c453624464593

    SHA256

    2e64a911e0d0eaba4a4c439ab2548db14d7bd1d4da50f281784137595ab3f78e

    SHA512

    97391a1a57f520d2c330d12dd0fe7f9c40c3a6272c0e11c4a3e0826571f8241442f2c1f5927f921c29f9dbe42ab5bf22674bd5bc85e2b51293f7fb401aba779f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

    Filesize

    170B

    MD5

    445c4f7dd3ad512b79aef8a7bbff7a15

    SHA1

    a57dc093b195aa708e1b9d378bdf9339cb1d984e

    SHA256

    1a734ad5eb5824651f89f1ae9f4e9b98f160d4b6ad6da04c2cfaa6a4435ef37f

    SHA512

    7ca2e675543d9fd881b7b549f624a92e9abc6d4cf40cd66bf66d627f56f0364fdb050f5345d1e52b835da05f2b320cce79ebdaa80701d7220ed39c555c264c63

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

    Filesize

    170B

    MD5

    14595424fc3224cb4b491ddf49369157

    SHA1

    09e221a74d700f8d6cda25df4ddda8a428a1ed63

    SHA256

    aa4b599b08835ea4b5548f20336403d2a0f45c77bef828771c942b9ba977053a

    SHA512

    d4a17287c64839c3fadcfb5c10a8dfb5051a86fbdab326363e5be4e8d134e372f34e6da1155b4970f0cfef0598d317154c17674aaaef26d59534574c9ab2156f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    470779c43153d08d34969b36f40c2257

    SHA1

    454b040a7f58d7a66a7498a7d70b8fb53e29bc58

    SHA256

    aad23a4beb1e17fa60377d369c04c6de14c8768bd63114ae5b76aae3c1b5d8b5

    SHA512

    94b5261c9ed0d77d65dd4a7d69fa14e62fdcf6d1e0b2a59a7594f8171114fff335c2e86e381eef565775b5ae5d03d0bbb24a22e2718b50a4ccab7cb88c883f9d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    8707ba917a034a7c93fe891ac58fc77b

    SHA1

    cae60506ca01759b740456c4a0fd8b841eb62d21

    SHA256

    43ea9c14235c0f5a6de2bc74e5d83eab6218a2c395d1458761afcd240fcc6705

    SHA512

    2e4857f117c7d9e88f901f97fed752a26372c3692caf1846c3cb0a4121663f6cf203606c39675ecdee5ca02e1f6b66976cf44ccbeb804bde332ea331ea1f4bbc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    f3cd9ee802311872bbc2ea63a92122bc

    SHA1

    dd50750120ebb214694f00013eff314aa5232f3b

    SHA256

    382b2017c831350c45888053a93331c2ec8af0a5175b0d41dc4f3d6cd1530d0d

    SHA512

    285e1021529899c17777fe19121cbd6d46c9fc090d5eea5a72ac55755e7fd76acf42e8b1732b5beede55803f56bea2c444af45dc676887ffa7c2fa106c2f6abe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bc042c0a3d140f99975be2306395f187

    SHA1

    61fcea5545e02e4d8b4f16f374a50b6dd1ee35ef

    SHA256

    8db5a142a4a8ef1374cf4fbe41a72a6ab53d1635bb8e55a04b4492984bacd45b

    SHA512

    f0c4c9675e46d59082499ade0dc2bb9a1fdb7b730160335413c41c6db5bc391aba2a716edc70cf4966eb0165bbcb94ef781efe522d378e446e0cdd339e643b31

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2b9032f99224b134199564fe72365bc7

    SHA1

    6981b23680d00b1b90b838297324ff8d170cb59d

    SHA256

    e422c92fc8ad95a43dc761ef9d349007b091405f943cc99dec6d4d342c289442

    SHA512

    6cbdd4a6949a5139a0f2653c22a09fa21f6189f1d6c73579d2feb895f14e61389965ba8b71e16b11259d74c5d7da0fe2b6e280fe2fcb80f81d4134db360ed0c7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c187c6f38fcf34891802ba6c50362cc9

    SHA1

    5009d7001d4f4eea2cc52404ec04b668855e79bb

    SHA256

    34a1ece6ee5eb1675690a6553d8fa54c02184b1f941e66f24e25b55ed8308af7

    SHA512

    a07a01b53f3717ab939200c7ca229c6b7140b16ea5db749080b9c8e06894a543e04b52d4f283287d6d11313d416e05d3d644b84ca5033313e6aec3e6058a3cdf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bcdab7f2a3a151ba9bf2b81d0a81f15d

    SHA1

    1fddc57a8fa5a984b2c06f22d94ada968d11fb21

    SHA256

    d0dc68675454ec2b80bd97fed18872edfd663bd09f9294b0240951babe2b5337

    SHA512

    afb84bd51f432a67a83cecf46fbebca7340d4ff31b9182ad7125f37e05294c59a0fd47881b53e787e17c96313ce751261349da1240e6a1091e897c1d9c2ba746

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    adf2cca67f32599a2ce3fea12ddf1b10

    SHA1

    729b1431fe47300fd0f454f609cd66c593e9491e

    SHA256

    9aa3f38bfe3ee9414d0b9cc521853855cdd323da92a04bf6668041316df801a9

    SHA512

    839c8d896f9170f145536b9e27a39c112dc1ff30b86748103e292e9f4852bb57eb953b3ec39f332b5df0851f2054a07168fd8f00102ac264ae2444454dfc08d8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a226327c65defad4e9e53f663a2d4c6f

    SHA1

    7454711a98e62ca90bc7ff759bfa2d5f8c28f788

    SHA256

    f0b09003bf604c906b76d37c94206c05f2255ac220613ee952656f0361581bfe

    SHA512

    15e373b1d7a0bf965ce18fd3a0fbb9ff391c6bf09eb55d4396d5a0b1f7d064f44678b2c9a0d7760a882f129fe6e6a19863a1b449fd77f47160c3fcb24b6c20e0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    75d5ba575542926f1c9aaf860b3dda2c

    SHA1

    79b06a89850bb939ced22f6ca57abce34f573623

    SHA256

    0de473863c623e53272dea227b4857a0b9e2d069262e9bb16c3d4bcfc22fc010

    SHA512

    1db8a8442d7a801d74ccc4581131405574c28aa9ad7b89a9cf41b699cc97e668cb55b4aaf07bc423bd7e6e5cdec82676804da3c8b2553c60f2be6323bb500269

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1af791bc693425007690361eb8507c26

    SHA1

    ae7d9b3454e017df988c64b44ac8c379147b6fe4

    SHA256

    472461e221d88b757a7d1bf7519734fb1080a61f6fa93ef97721af8db0a650c8

    SHA512

    40691485bcfa5bc03b22e46772b48606da06e7787cc1d1ce2c925b9bb0d392ba43f8fd6e09954e05cae2f045b54903b201711101d0f0aa25ed028ff3cac0021f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d67fb23f848254dcf91dd4c27fe0720b

    SHA1

    d9c3650d8432262268104e3199c27b5c81457796

    SHA256

    a4e6ef5bc4263d7a0b9538a940ba4f635fa5313bcd3a1ddac0e11de68a0111e6

    SHA512

    be11741e1a4f1bbbdfde017ec11b3f395bd22f596ead4605aa5f7787794a86f0a77de685e9bf7fed952b66d024f4f4fb505ee3218791bb8958797fbd79810387

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a96278df0ca0dcee79c854dfa74fb01d

    SHA1

    5963fd91b9c5fef7980f8c778ff96235165799d3

    SHA256

    e2de8ac4cd7998a641b615d4690974d7774eb2dc1a4539c9ab6f5cf543b8c683

    SHA512

    1965c3fca0eca93a222353e0d931cdb72891311b0f371ad48bf36ad667f8e85fea42b3106ca5635365162f3c21ffcf9c6d93c7214672b2f2877a367f9c074d81

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ad3936dec6b636a15c134cef1af981e9

    SHA1

    3351104be1ee92588a0176436ab9f549a0d93761

    SHA256

    4dc2e1ea79936caaedeec21dd1cca9e91e1b451969a93652f9174d3c1e25e1c1

    SHA512

    b6ab51dd022bc9fe1428bf7b78093e8c9eb3181edf42bad435fded0cf68c583012efd3865b530b36bda72d00378692336867a06c3fb4dd4a830f13a75cdb149e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_147AB4536A182B9FCE88E194D59F3B22

    Filesize

    402B

    MD5

    8b4c070e3db611545f51599639ae90ff

    SHA1

    3bb6390dd63c2e10e30cd0155de384f2036dfb9b

    SHA256

    eee5fc002ac94aebcae3fce311a08f4c21a5009218c6e9177144ab3336fa019e

    SHA512

    e8b0216be2e11e0fecb01c1c905148898cf41fb4654c7510f3322e5345198f972fe58bf96d7382fba24da87138412c711673ed639ee722614f2a41b62492897b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

    Filesize

    400B

    MD5

    c87b4ea80b318cc1d78cd1477e8349c9

    SHA1

    f58249d308551f091316615265c626da2f5e1cc0

    SHA256

    94359d9108aad9a0346fa6cdac2da7b38289f73c1f14f38ed03e7e6520295379

    SHA512

    2264d16e8b2181532f33fd331587d7c4062033cbf7877b4891b202c5061a1b842d65036242441e647cdd09a5327d54cb90e849605283f88e97c240f56ea2c5d5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    fd6e5c7abc2ff6bab46a66a64690ed2e

    SHA1

    742152548761228188d7d2b67f7a9651667a72ac

    SHA256

    dea1ad8945e75ea06df75f05087bd6ddbca6a57f67649fd68ee9ffc7d3aa6a11

    SHA512

    fd124e2812bac48a68de930752798161086b3dd3af396bedd724652f7b7d3be7bca7000737afc41af96e3644876f79c500c92c4db5c5eb747569ea0498ae39f8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    aae57eb420e2ea61d5eea6acfcc55165

    SHA1

    523d07f0a8c4673c3e31b3f9faa11f556fdf836a

    SHA256

    0bcb2f04ab5418269073b686252e4b37cede5bd28a698e0d69ac7632b5ad7a9e

    SHA512

    4caa80503e572843e3cfc37f420cfddb19c164406cd5a81ed7de321bb8d5ce89d09457a158e712b8d1386fe9f25984cd9a0f97bbf49087baf9e263f23837678e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VCY0HBA7\plusone[1].js

    Filesize

    63KB

    MD5

    65d165a4d38bfc0c83b38d98e488f063

    SHA1

    1c4ed17c5598a07358f88018a4872aa37ae8bc07

    SHA256

    b1320e0dda0858c87971f7baa0d53063ad2a429d232fd06b0067bda8b9eeb0ec

    SHA512

    abf4c755d88193e7e05398b6f934fc561d8e2adbee7d2170af399e145e54a4a8a93988e4af4e28d6240c0bd1bda7035ae97f67a85a471088820baae8d89f3d41

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WNZH54VQ\3566091532-css_bundle_v2[1].css

    Filesize

    35KB

    MD5

    1e32420a7b6ddbdcb7def8b3141c4d1e

    SHA1

    a1be54d42ff1f95244c9653539f90318f5bc0580

    SHA256

    a9ca837900b6ae007386d400f659c233120b8af7d93407fd6475c9180d9e83d2

    SHA512

    1357d702a78ffa97f5aba313bcd1f94d7d80fb6dd15d293ff36acc4fb063ffdad6d9f7e8d911b1bbe696c7ad1cde4c3d52fb2db2a0fcf6ff8ef154824e013c6d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WNZH54VQ\815507830-widgets[1].js

    Filesize

    142KB

    MD5

    e22b733357f696505bf0d1d88b0aa66f

    SHA1

    93356d84661faf36975fb0b5885919ea01fdaeb3

    SHA256

    897bfe41652bb122534d151228389abb0ad6a7b6ef57a2c92af5ee03ada0020c

    SHA512

    48be5314ef48d9775aaa8acfacb784d998d5a9693a8c53142ef2c25878313c366532868a552bc52226d4d363427da7178c8a0cd393e3ffbbe8daff1e0b1e0617

  • C:\Users\Admin\AppData\Local\Temp\CabF079.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarF0F9.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b