Analysis

  • max time kernel
    132s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    25-08-2024 18:08

General

  • Target

    c149183688c4b9a2f4d180b0da85d505_JaffaCakes118.html

  • Size

    226KB

  • MD5

    c149183688c4b9a2f4d180b0da85d505

  • SHA1

    8b9afb1dfd4b4cfab5d75bf83415442a01b5c496

  • SHA256

    60a78d553dafbcb136620c50b23f7f73f3a09a7fcab4d52623135666c71a8e80

  • SHA512

    3b59c2709b2b01bbb5f3fd240e6e80dfe767cbad91d792131aee86d66d4e15e7bda78ef721194319341a190a694da882cde256e5ff9363698ab8bb3eccbb985d

  • SSDEEP

    3072:KvwnqG5bW4KY65h65h65h65h65h65h65h65h65h65h65h65ZETVt54ADT5Pwwye1:swDETVUAJ5

Malware Config

Signatures

  • SocGholish

    SocGholish is a JavaScript payload that downloads other malware.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c149183688c4b9a2f4d180b0da85d505_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2528

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    2dba5e44d08483df263ca3a74f0bb229

    SHA1

    7fa4dbd60451e79833ad313b1f1232b52e1c63d9

    SHA256

    36eb20325490b4d8e100d368f1c6b285d20230a2b42a2ed35d5f9bac83ae2fcb

    SHA512

    96d10f4888a65e5dfca08b150b7b32eb7d8422adaf6be6a0d426ba1e70c9f67e4000093635b67efdfe101a365fb802a8f1288f2b1d4f97661d050e7924395514

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    4678a65ddd9a0bb6825732162a62b090

    SHA1

    58b090b645feaf07a56d90123290c9fc4addf61f

    SHA256

    d8cc6df80f794b6798222e6f3f12a1d405a3a549c538285eb9f134c0f3c1ad77

    SHA512

    ddcc947696c8d6385d44aedbd148aff26780c4df6743fba8a320d81d926009291a89b2786b3d14fb4884508e35b31016d85adc2fb596cd8a330ad3a6b29eab66

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    a9e49059de4d278f34aa8b1058486369

    SHA1

    0dae78ec728067c17f0dcd336265fc743653322c

    SHA256

    742180e3ead7b3384ca6139cb588daa2dbe323aae95dd5652b6b12ffc52eeddf

    SHA512

    2e004ad855cee04a6ff94f020dcafb018f5e53481cb61497c0252011186573e6b11db2be1b9151d2dd3106f76d8e4433ecb67cdd04416182923ba2893ecf55a2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    8f2c5c384cd9567c04425daf72750be7

    SHA1

    1d1cb32fbb7a8596fcb34c2651d5d7f59ef1f8c9

    SHA256

    4b0a8d43256382918337b7c81f6dbb9e3a4194de3f09e56427a13b41fa2d9068

    SHA512

    7b8376a4e4d7ae46ff8166be5f848e6acb238bf3e0ca57f82967a84e3797579a9e92ecd21376fa28aeadc3bf5e4308899ae360af2adf0134a89508b750351997

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    b49ba8d71cb40a3be7fdffdcd0bad2cf

    SHA1

    d05d837f128e638c2ebcce3e2fae47be3624eca1

    SHA256

    ef2c9172ac2592901a7415c75954847f79d23d3645e91a8f9dae61480b37f70b

    SHA512

    9a6fd6480d49d69631b4c68d132e2f04c042afb5e7d577d1b9dbc34b77ac292463f23538da6d77aff1ae80a21f7f9f4a97aa4ebe254470a75b3999ea65b05da9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    a92ac4c4e3efd326cd5e4168b7e551de

    SHA1

    c85a4f01e9bff802c311c67a1e0ae21460cb7ce7

    SHA256

    5dc99b03cfe46a81e78124f5ac3976f8d89dd16a570a0e8e0f62b5f8d55778f7

    SHA512

    9588478b2560dc36b8a53c4c1b2d59e21994d17a57f0d0e0c2fde668c588ea2a640d0ae5be8f96328f1cad8d8a718e73d5276535e4daef077aceb0ff408ae096

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    7162039cdea647b58c7ad38c8072e2c4

    SHA1

    e73013d578fb995bc65d30a0ae5765164eadee07

    SHA256

    f882fd86f801b3801788b4c133eb180413e3d2e6f7fe7ed8852e93128f50d193

    SHA512

    1cd0df7aeefc141ada2a9f0f4c288cfbd6d60cecb75991375c790603bdfa17f69fdb9bae905b50ad523513b45feabdd4e8a28c18b85d2dd1a0eab9e8e4a2f2c1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    8abbf1a284e13a77704453416b658947

    SHA1

    93cafc3fa82bed2cdd1f8388e438c42a31ecf664

    SHA256

    d8022a0d1c6ffcf224c75b429a2e1974b6a6170c21107b43b9fc609ce06b697d

    SHA512

    3f1f886f10b3d5aa36e7dd043eafd06df74a98293c7928a80469e17e45e6f98483a501f3b4956025171b094616f3d5c7792208aa6a53ce6adfba4d455eaebcf5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    f6826cdb016071c970dc9023424c78ad

    SHA1

    ba78f2560600047790bea9366a42d1197907aea3

    SHA256

    48b0011dbc92a78ee8814f57e2294c130448acff7dca86a17dd8a3971fb4ccb3

    SHA512

    6aef8ca5ad46da88f31b9c2b0031dd005787fb01a62b1f1d1379a5359c9088c1ac8e74f3780c59f99a7430d3778569d6059671553107f2d3579d9fce3bd2cc77

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    8303d30c9e70907ce1e55468fa4784c3

    SHA1

    fa098fcd42030d2835132a61a6d9277d7b4e2363

    SHA256

    fdb03b0dbe675000ddeb6f7a58fe66aa4d002b48e5fdb2d94e5f858c90ecbcdd

    SHA512

    2ca2e5785de84fe4c5ca81ca7805ed0b524e23e80db8136a4a1e601fc9455d283d1f25a5499ddd7a391c1308108cdecf7a6c9d4114473951c9ae7ff3b9249fa6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    fe820c8674c5c2e5fbe843c47e2061bb

    SHA1

    2baebc1e729effa955a5d56c2296cd86ce6f749e

    SHA256

    2a7118f3625bd89193db4ac523df2f5051cbcd409c576ca5b1260d5ff80b722d

    SHA512

    90cb288e842233d1335b200bb840c31c11fa04de4a00f9d18a063e4d79a60b51e740fd84aec4adacaf99b056a7697f51633e95127d2536052abe0385d825f6b9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    3d2a76e2d00ffcebe777e347ddd0f858

    SHA1

    1e75cc93f1b1791bf7c449020c665739a038d58e

    SHA256

    3f49df2ee4fe2b3351c4c91dfedecb7e167e7554a93d93a8f7dc5369e14fa5f5

    SHA512

    7da883b0f35b6989c6972bf80693ecffe8a242e320ebd3ed49265ff4eae5f7a4255a100970b54631596c3d44cd9fc4a92ee809abbdaa35affa297e34c29a028a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    fe115c0636aa02892051b4c7a3a15817

    SHA1

    8c528013b81bff3896a35d54c7c2940bba7ead56

    SHA256

    0753adab3cfb554a665d060ffbf77f0ed4c2c9f97fe6e01d02abe1c6b3f215fc

    SHA512

    6e49372f3734ca0a3308061b5fd92ca8e823a77db1e5da384f4887a498dbaa6747f61a7651360e4257e33e64c0a84b0d4776fd148588f73f8d3e4899ee9e57d1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    c287b40f52192661191836cf3dc2c152

    SHA1

    5b7a4c6fc49570bdcd4009662b5ca4da2c0c29ac

    SHA256

    fea75144b2cf043e8b0f786b844f79d894505c5f7e47152b5a5ef3908aa8c8ea

    SHA512

    e19f1ac312aa178dc5023b905851b64e6f8719b073011ed78f1d58727d4d55515dc7987c6bd08275772d9affc6d2de700e9ce687693b411fcbd6b5bec89c0f9e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    38dd479e2edc45dde9db825831db2d22

    SHA1

    cc2781d69eb9e0cacfc0cfc57012b98fcdc9d281

    SHA256

    9fcd849e3d6210a2aabb0094eb6293b49fd67ce794224ec9c255e3473f2502e3

    SHA512

    0162d96a147781bf5441a91339d7b994269757d51ebeaa59d4a28bab359a9ade49bf8db331595a2e6f8cc205d7591d8c004078ac84c4f6cbfd6ad1543774ec4b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    3132b84fb2d439987a053d37e07a7414

    SHA1

    37005da7605f37728cdbe54106951a5cf1692ef4

    SHA256

    1193c7b0b3447cd93a1475a93c0066412caeb2ba848ecede82263b3824a84670

    SHA512

    0dcf4ad4e1abb39b4ed57d62726755e7c41f98860e919a437c881922db3beec70609fd993850ccfaf6c9aab772c697a6840708b995648a3aa4cc427c998a8703

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    2d3af420d87545b720ef376d725c6860

    SHA1

    12a3a761abbc88afa0ad20f890238a975d109519

    SHA256

    5c3c532e499344218b0ded7cb5806e1b2bf7006eeb2dca192ad2465453e2d9bf

    SHA512

    ac69e444cfcb39ae064aa5f7ef0bc3716defcbb8208bd59711c06960ddec8ee20db12d2531b5219656c24700ed517ecc2b9d668f70c5e12b05cc5c3ebe9c8858

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2LF9I1AK\dnserrordiagoff[1]

    Filesize

    1KB

    MD5

    47f581b112d58eda23ea8b2e08cf0ff0

    SHA1

    6ec1df5eaec1439573aef0fb96dabfc953305e5b

    SHA256

    b1c947d00db5fce43314c56c663dbeae0ffa13407c9c16225c17ccefc3afa928

    SHA512

    187383eef3d646091e9f68eff680a11c7947b3d9b54a78cc6de4a04629d7037e9c97673ac054a6f1cf591235c110ca181a6b69ecba0e5032168f56f4486fff92

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4MP1SLKR\errorPageStrings[1]

    Filesize

    2KB

    MD5

    e3e4a98353f119b80b323302f26b78fa

    SHA1

    20ee35a370cdd3a8a7d04b506410300fd0a6a864

    SHA256

    9466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66

    SHA512

    d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4UQ4J2DQ\TMFTPX3A.htm

    Filesize

    574B

    MD5

    32544a2a9f9ef23b1a3bebb86809789d

    SHA1

    a3b8fba39d6aa35e6b8048225dd8792387417b34

    SHA256

    5110837d60248dfddb6855ab865c8a8ad1276fe34637e1590e98c98dcb6df288

    SHA512

    02f046aead0448f04049795d838891e3c271adb1c8929041e8b23f46898942bfc79ceedf7ea8f749b577b176000dd0d06a9e0be3db1885906cf2533701c0f53a

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4UQ4J2DQ\cb=gapi[2].js

    Filesize

    67KB

    MD5

    b4b711f3e747704ffe02b49791ce8cac

    SHA1

    ac7ce4cbd3c8ee66e3c8d9d209c1352c160c3b89

    SHA256

    f65bf40e2f0ce993b54772f703f72d53f0fa925457346fa8ec2031879ffa91d1

    SHA512

    b738deba57337a9147927f7dd35eab7c999dea6d2ff11f57fdc2e5b6f64326028a54778886548ba128a3f03ee333cc9e43de5162d8b578b85c290626577042db

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4UQ4J2DQ\httpErrorPagesScripts[1]

    Filesize

    8KB

    MD5

    3f57b781cb3ef114dd0b665151571b7b

    SHA1

    ce6a63f996df3a1cccb81720e21204b825e0238c

    SHA256

    46e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad

    SHA512

    8cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\69P6875H\1380534674-postmessagerelay[1].js

    Filesize

    10KB

    MD5

    c1d4d816ecb8889abf691542c9c69f6a

    SHA1

    27907b46be6f9fe5886a75ee3c97f020f8365e20

    SHA256

    01a956fa0b3ea8cb90d7032608512bc289c4170bf92759352e40062d5be2946f

    SHA512

    f534f057e46998bd1ff2c423ad2cf04a880c4a5259e95aee5c6ae34ce7121ccd07ad1bce5d4c3a51ad04f7411b0625da78808326b13d2aeefec502988e113113

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\69P6875H\rpc_shindig_random[1].js

    Filesize

    14KB

    MD5

    45a63d2d3cfdd75f83979bb6a46a0194

    SHA1

    d8e35a59be139958da4c891b1ef53c2316462583

    SHA256

    f7067f1d01d9c60618becbe4df3d61778244108459226e2e8a818cfbc2c18ae6

    SHA512

    cea9c9eb8ff0c43048ff371f135148438fc1a2614bf8bbc3518cf430c37778edba3452ce92b4236679cd1a4123af0ca320f530b1c20cedd0883b545209c048cc

  • C:\Users\Admin\AppData\Local\Temp\CabD5E7.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarD619.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b