Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26-08-2024 17:53
Static task
static1
Behavioral task
behavioral1
Sample
c3887c73d92f7095655941ab27626354_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c3887c73d92f7095655941ab27626354_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c3887c73d92f7095655941ab27626354_JaffaCakes118.html
-
Size
126KB
-
MD5
c3887c73d92f7095655941ab27626354
-
SHA1
6e35ed331bae64753dc12de83afffcf9b8d0949e
-
SHA256
a37fcdadcd2a2319b7bf7606825eb10945f66f5b7d7cb4306a80980414628386
-
SHA512
08abfe4351670df453e5e0cfc05fbcfa2d832fdc876458a386df97cd526b52cffa4afc3f5d3a7d77b1df85c76ffd3cb3b997ee10d6904b75e9a348990088321c
-
SSDEEP
3072:9UcjvG8rMdcXmNRS4as044PV7OKILBszrM+7G:nrXmNRyw
Malware Config
Signatures
-
SocGholish
SocGholish is a JavaScript payload that downloads other malware.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
IEXPLORE.EXEdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430856702" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{25FDE6E1-63D4-11EF-845E-D61F2295B977} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2792 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2792 iexplore.exe 2792 iexplore.exe 2920 IEXPLORE.EXE 2920 IEXPLORE.EXE 2920 IEXPLORE.EXE 2920 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
iexplore.exedescription pid process target process PID 2792 wrote to memory of 2920 2792 iexplore.exe IEXPLORE.EXE PID 2792 wrote to memory of 2920 2792 iexplore.exe IEXPLORE.EXE PID 2792 wrote to memory of 2920 2792 iexplore.exe IEXPLORE.EXE PID 2792 wrote to memory of 2920 2792 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c3887c73d92f7095655941ab27626354_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2792 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
854B
MD5e935bc5762068caf3e24a2683b1b8a88
SHA182b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA256a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
SHA512bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5eecdf0a7dcf35d061d4f6ef3a799307f
SHA19204d28a1720eb5f94c303ed96a0b9330cceb647
SHA25637e52308a382dfa7a2233b3a708175fe7945ed6c90605ec50c7171971c06f923
SHA512370a6a75c2328eb5c37ba8817c145b571108644edb28ea84e8fc6a759006161cffad3db4f21d6d00b492894d1ea7f07653aeaa325f6f7eb74ea48e96aee8ca65
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
Filesize170B
MD5379dbf36e434e466e73e3d8625c0aec1
SHA13133fdfd0d42e2fd1bda12b9757355353e393718
SHA256f9b8718635525f11f5aba543be9b7e23277f932a3eb3c036cd82db5d5ac9de58
SHA51237d06468def2a3c6bc63f4bb23c1b9436b64731381523f57d1db9ba4b934fe2f386124d210d7719816802ae8bee163da41a27daecd0671fd05077357992adf90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
Filesize170B
MD5375a2c2d434d6713c7fe0802eb9b61b4
SHA19047081ab6c3123436295b6208fedf9250f91f74
SHA25613a1beec87fefaba947680810350b4d0b57fb93beeec3b3df18de7fe806025a1
SHA51273c233dbf0cc8fcdf53d73d6852237fa5df1b40ba53e64fd542e077fc49835bb1db3eec28b3f92fc3de9af4445aa682ffa85851b000fe3d02582f7f5c3506e95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5159377bcecf81d1243f5615628ba7b61
SHA1bf143d094d2b45dca1e94c83e5d230e953be5320
SHA2564c4222452b82c41cf7390c4ad58d278fb8399929f892fa8f8b376dc818c406e7
SHA512b3b55118a8542f12e93191e77e51f7af5a882a4a698d36657f7ec8a92f180a593715debdcef8aadfbe942ff808b7516280ff4d0491a95515d2141bb2b613b562
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5076462b24d6019ad37ad40ed77cb2cb8
SHA13279a5ee90f33ac18bc5c1f74c442242bf1eb471
SHA256c2a140cb14d6bc9829b3a4507e8fb12a6c39d4ba050506b6654a6ed5af1516ab
SHA512f69e498a2ad6d459e5d6a8671da8afb84d7737d3a3d1e73f50290e6b352cb0b40f57f5b635654300fe9089865d812e182ef54ecb188e85663c7222a4a5b6338c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e787dc0629b445136b12028eb563f8c5
SHA1a6704aec285c4939fc45ef11ea85a7780a24d11d
SHA256fa30a714404e61bd26397567e71328aca68ee61eb840d28ea7c789e683a2488a
SHA5127050c1ca5cda10ed5dee74a893a7cf3bf4d9e5fba4306c0e38cd966464bc5d8e67657c830c29ea729149d043447148eeaac96337b2853de7ff452f399f807863
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Filesize170B
MD5a4ba82b5586bd57e209f4095d4e1ef92
SHA19e4a0ff503d376930b024fd060052391a031df52
SHA256fc624fae0b7c21b0586c73f0cc2d82fe01b9c281c2e7ebc155142880b894457e
SHA512aebec76ba18f55d67764a7e4c1859fe9ec004366fbf261c6bc4d585336fdc65481e39f8dbd7244d1fff7c94fd2fa09cc71d319217985a4288201fde94c18ef76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD517eb278abf02638c2e81575afb99d99a
SHA14a26381ca5ba70d18342c6c31772a3c12b5f29bc
SHA256117c7c637ad7ae1357debdcbf6cd32cf6ea80a82008f5829cdb73849ad06dd1c
SHA5127c933f3b8dc6ef9efe0482faee532b52dc6730c27449f5e089e0d19054b3d16880c807dcd259b61307a77e2c9ea135c0352878110619fd078886b4afa7fd3cc3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M7H6XY0V\1380534674-postmessagerelay[1].js
Filesize10KB
MD5c1d4d816ecb8889abf691542c9c69f6a
SHA127907b46be6f9fe5886a75ee3c97f020f8365e20
SHA25601a956fa0b3ea8cb90d7032608512bc289c4170bf92759352e40062d5be2946f
SHA512f534f057e46998bd1ff2c423ad2cf04a880c4a5259e95aee5c6ae34ce7121ccd07ad1bce5d4c3a51ad04f7411b0625da78808326b13d2aeefec502988e113113
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M7H6XY0V\rpc_shindig_random[1].js
Filesize14KB
MD545a63d2d3cfdd75f83979bb6a46a0194
SHA1d8e35a59be139958da4c891b1ef53c2316462583
SHA256f7067f1d01d9c60618becbe4df3d61778244108459226e2e8a818cfbc2c18ae6
SHA512cea9c9eb8ff0c43048ff371f135148438fc1a2614bf8bbc3518cf430c37778edba3452ce92b4236679cd1a4123af0ca320f530b1c20cedd0883b545209c048cc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VCY0HBA7\cb=gapi[1].js
Filesize67KB
MD5ed72d618fe48f6fc42c19a4b58511e72
SHA180a2da4af91d56ec81c7b672afaaaa72c83a4414
SHA2565bfd37a756bc7772aa6c520102870dafe2d3b808c562412e30f122a7908f8ad0
SHA5125378b71a33f67309f788b9fce32daea44051e7e9a6aa326bdd783456ee9eb2f4817aec2ad1e837afc1853acba59080b0114d32c040ea731ebd703f0a84dd7ae1
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b