Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    14/09/2024, 23:18

General

  • Target

    e13be6f40bedf91595e32da9b235a90c_JaffaCakes118.exe

  • Size

    26KB

  • MD5

    e13be6f40bedf91595e32da9b235a90c

  • SHA1

    a9a5389564f5c6be4a871812ad6752ea3d833891

  • SHA256

    00a62b82cbf7e328428064b652b9eb86a25cdf6657fe0ad649180053623683e7

  • SHA512

    19eec72480ac75a3d69dcbd9784913047f63290490f9d0a5cd2b1fcb5b83e663483156fbb39d8e5ff28aa4640b928603d36b8ebd2aaa940fe87e42a94d661ea4

  • SSDEEP

    768:pNw9EM3FW0WQ8YgfbHRcag1fj2jMkHaIw:j7WWbYgjGF1fj2jMkrw

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e13be6f40bedf91595e32da9b235a90c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e13be6f40bedf91595e32da9b235a90c_JaffaCakes118.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://voxcards.ig.com.br/secoes/1/cartao/c13_amor_nuncaseesqueca1205.swf
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2564
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2564 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2836

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    9526e9a1871288ea995cf094ec09c110

    SHA1

    c1ac9ab0e290552dd337424e0101f262bb04f6cf

    SHA256

    5b4b4d62e5b0e72a24dc2ddc6f7cf9bbc53007190843634ddf24999124a985a8

    SHA512

    c8a5a01c2a6fcf6cddde3936b2edac3f2167285c5c24d4432fb6d39727a89a55776136aac2d59050cf22c3f0467724871bb3162a1ab4fff62d8277c0df935ae5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e60729fc11d7680c33d58c97fdd49a29

    SHA1

    158355ad5f9b531589e978d1676387bbbb01f70c

    SHA256

    a69115b40ffc15e125f4ff123a2a948953132a1c80fdb5501e266581034a5b4f

    SHA512

    977857e912a8c87ec1118d51e2975fc094b632199049233b9d3030dec516c09b86b46e73d38ae27f1f69e9cd652c386c49e80eefc8e37e06139277309d2773e5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ee58dc24de10e47e00cc69a7b56ce551

    SHA1

    75a7ef01520f0842209ef7ece33ada98ad1faaac

    SHA256

    d78c522391088c629ddf46c7c2b7bcba971df00f1e0575ee997c776f3b0e31ec

    SHA512

    02e6a0ae30e64d343b1e91c1070ef6f85d21d62f10ec530fb792f87ed08c40494f7112cc8b9c9a3d2816c8bcb18a6490d3f24f9755c513fb904c3727a0c0c35e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9c0352a2e0d05a44d1c7932de1adeb4f

    SHA1

    b19115f608e86e2fc35cb400e717f949839ca9a2

    SHA256

    bff6f6b0d7d84eb835cd663e6cb9075299e74c4138c24e2b70e74a9dc39df852

    SHA512

    e307871c53209dd27726dcf801a8057984508ba3570e2e00ec39e79042c45bc0b7769229005bf31cfed5635f2451193284d7c526bcf9c94c284f9e52e414ac46

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    540e1abb1182ef5585dc8abedbee5959

    SHA1

    ef395e313529d89484edf7e632637d4b820436ef

    SHA256

    5967d16241e14c17e318b594347c432dde017366a35ac6cfd3a5db385628a527

    SHA512

    f2670670ae36ab53dd0d75ea25d6f7bec216a36d1077a8d2e6bead7816becd7448b5d152b5ef604c19bc4997d613a0544ba41042e181bfa0955b1ae1fba9e6fd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    370d3dc118dd85a95ad99860d1e8116f

    SHA1

    dc3f28eab5da1d73b0a39fb58e0e9cb405e68201

    SHA256

    7a5a456b96749858932e7436aed737756065941fda7f59bdafdb5feb9c3cbf15

    SHA512

    da3e07d0ca0517ae0e4721500e864d50bf955517428370a3ea14afb2db93569088d12d1a07c940c4c417f0a60c7409ab29f3ba5f424010a805ec39229e285742

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0c6559ae6ce9d23542d6d64d13e88a81

    SHA1

    4286f899108a64d3e82a0a4ccd3e17366b266beb

    SHA256

    0235a7a860faa64c00f7430e49024a21bfbf6624af4f49ab7a078154abc4c81b

    SHA512

    58fccbe317621d1750785a9495d65d09b19a379047b915d92b68608b45eeb640560a9c7947b2b26ac8d526e49a37e6bd928a76b351bb1eb2076f4bce0401f1eb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    06fb079102cb560018e48d1e21cb1e05

    SHA1

    acb3a1382d5e0b248441f2c5f70fb70e8db06e4e

    SHA256

    0e6ff0ce94f7914d7fe80722369dd94f94b3ce9519139700531f7bdf17ebf143

    SHA512

    d8771fe78d6492961aa3f5510655b75e2db947f9f763ac7213f086cd690076eaf02d1d137771da1d15c15d32070b047917f7d9c933220e60cf18d0bbced36a33

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c17bfaf35f4274c1e5c54069bd56beb8

    SHA1

    81ff39cf3a32edced9b21c570f992f7515470a4b

    SHA256

    a57bc460f008c3d097123369910ea16109bb4bc2e44934ad01385bae183571b0

    SHA512

    efcb4a510d35232e2fae02504facf75710824611d7afa00ed4305e226ba44bda50241201cd8df8510db692bd9377f48595a7df9d9d76cc1570389453aaf992c6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6495b7a8ef2c724af782d6c5ba764151

    SHA1

    52bfcc3db94a2fb15f3de99cdb2934c75734b783

    SHA256

    0337e41c76027c4b6ff66cf6878b1a54c3b778d6163f6361e1d447ee2089cba9

    SHA512

    ad8e9640c2ec7ba0c4658d71f64e259406884581d8827eafc4e743cf622a660b5c52873c7bd9d26a59046be297db6882a32eb0a066883db4920e81dd2da4c1bc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    31be248ca82a3adaca301278d5d0ff0b

    SHA1

    a207ff2604cca0b2f0d361ce7aa07314f82282cb

    SHA256

    4444684908105a296cef19863cab565776d8ebccd3b93a4f5ef3f505b972b040

    SHA512

    be4a126a92141f199b6274570f6327e74632a27e050030260d01659fad9748f4dc82221daca74d79135d490143d2371ef1de41a0424ddaca121f4617ee81e332

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    df21820f1cc74680ef2f2a3b358e4571

    SHA1

    f61348e2ccd65fc7c7a47374b408b877e9becf4d

    SHA256

    204e37c72411ea55e759cdccc5ef3a62f1cda9f91a2727cb8b548f0cd37c7c20

    SHA512

    f9d0720d3fd607065a776e96985fdfaa01b1c6384d18a3aed57e8dd490e77ff63c3194d00a597b05edc598faf08e4b3b8c7792d62f693fff10eda88c04d1f4a6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f9aa9781ef742ec36d71118ab8e8a70b

    SHA1

    81380625239b662fd07e419703d6d532ded38e58

    SHA256

    e1a0ee5fbe34350247d70ac60229c22e16e9d4b1a353c77d7e69451eb8e31a8e

    SHA512

    06f92d0577c587f52c0876a0e1bcf0bf1ddf3ad30a587aed3ac4cf9bd3aaea1042994eae1a94d894fcca4f50cab2d51d30bc200f49b51a0bad21cff4ca10cd19

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d121eb653b79b963c67adfe720d314de

    SHA1

    561fb3759e18caceedc2ef1effd916f5115d3456

    SHA256

    0e2a8d2c3578a73a71ffdbd33762facc69b33fcbaa4dd709f0726c7664a43c8f

    SHA512

    1cd8d161819f6c854560319ff635e2989d6e6624fe3b4ec5836bd7fb1df51a62c2c121cf7cb05e4c16a0ef76607ec9da1a65f4e20812a3864bfc35c25dfe7e7a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    eea6016ec7370f607b563fa24b0a4bf8

    SHA1

    6f432aa71b1dc8c395265356baf058a09ca8ea0b

    SHA256

    0ad163a7b36d65edc1ffad36e29de7e5141bb608de870ec061da309ea6f0eb83

    SHA512

    035b259ca928ddecf7ecdca953ed671678ba2120fe8218a298b43228104455950caca3e1367c1a118225eb39864045b88d1d1fd3fb4acf71893c078e131542a3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    401c2218bb6e3aa6f3e25ac55c51d439

    SHA1

    1442cceea4c3cadaea19e5562337ba81606a3994

    SHA256

    8fed1c461269245fc0dd0078ce99476fb17c0195963b13a7212dc5e96361273d

    SHA512

    36c91e81873f91c6016c5b62ead6c0eceb1cd15e220cd8014855f24d45f73474c273eca5471ced7cd0950603813040c242b15c72008bc8432ef0c76c2cd6e7ee

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7b056be97bdf440ffcde8268f9bd2519

    SHA1

    0aadc9714d2d1c5fd974fdf0eab9f5054fddef8a

    SHA256

    ae818af02a8edd38913c933775e5e48d8f2cd5bbd18e528e7080154da1d99515

    SHA512

    89b1c5b9fe92a708a145ebc4aa889eb5e2774a86f14ae832ee1d739c8a401af1e2112a9486b2566c64c2e4c6d02d895f916eb5d6c268d383d6f58a1649b5506f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3e46a63fc0a7fe16fd4ef1b7e025f8c5

    SHA1

    f1569bf104dfac923d3167cddb065542055de415

    SHA256

    ad124c4400ef724bf27250c91ff619b76d06deccf97967bd066ea1afc6a963a0

    SHA512

    d53e5a547587fbacfc1972631a733a4f9cb8a72104f37a2debe6c34dce60338417f518d82b0a419a2dd8419a9e84ea58f357da26e1d88cd3cd39524201969ce2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7ae48244c2b531b85ed0be3f9895eeca

    SHA1

    1a3899358d472c092e148c447c2ee5ee4e3d3617

    SHA256

    28cd3b2adfb4bfb6c11671c7497b0446de7f8426f6ebd3760dc1520c0b5587bf

    SHA512

    8e4cad5eaccbc8d3b5b775aa663dee3a8fd5908d29191b13a4b1b471a31809abc56aa9082d7bf56a6cc08be523380dcffff06651e8da63b5c2fe08193644e31c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ac023e019f0cec8da37c80f8e16ce63c

    SHA1

    f9cbf71b4edc8e66375fe2b0f6b864e9097702c7

    SHA256

    9d333caa711d58ddee4cdafb837e964ac776abde37bd69f2c090913037b99259

    SHA512

    464ded0dfa2cc3956481d263cdbc4c5f8873c892242500aa68d8d8fa67735f8097dbbba71759ef0b78d72ed107454a7bf8a6e94e2f8e7feff86f2112e237de95

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7e2c75d74bbbf4d209cd272ce7e395f5

    SHA1

    4b9ea9912a8f3f7ed3d0f1f423d9d0f5a3d08def

    SHA256

    c466768e1d67676cdbf8bc955e6993a994d63409f5fa85578c0402112a4a2f0f

    SHA512

    44784633efdc56c6a63207515d6bac0c2a8664c726ddb1b261568bde2cf2fbea632c97eef46771f553456ed83d53cff80db94064ec5e0ca33f6b9d6d052e7906

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3646575f11e84cb9935abe303a2049c6

    SHA1

    f1c6b4122760588c84850834ddaab0246dc694ff

    SHA256

    a01769e97ed7b38048cfbd9cbfa04f9cef48dd283ee743350f787ce4ff63dd4a

    SHA512

    e3212ff9844a24d7994b0419386dfc5d54888bfd26b4231ed659a1de3246052e090a17f45fcf2f3f72371ffe99aff78b5979e0d9fec719f95967bce9c08370f6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d8a02b9658c9efa565fac89eff72fb6a

    SHA1

    7dbbf50e9788ce2d1ec6c7a58aeaac5313006c01

    SHA256

    0605c907ca7ef4d115fa2f1d1f10bd94c54625192c6cf9b36a24d8ad6e5ec146

    SHA512

    75c9a02c32ef3b4315bf5387301c3507dceab2a603199f800032084f9a377ce3567bbdcfa66d41f11b3eaf882eea83a11eec2c692c4e16ac890d28aaaa3d1d05

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C02877841121CC45139CB51404116B25_193C88518F770D3F8D3CDA4F180E8635

    Filesize

    398B

    MD5

    b14b9fee8f82862a97671fa176368e8e

    SHA1

    38f74777a42ad7a058c02d62c07a00408ce3966d

    SHA256

    2cae080cbe8c5e638a281495f3f7b802fe59fe021bd2daaf3b2e8bac3864c77b

    SHA512

    1a110e3657fbaf7e5707c36a748dc88daf6149a69267bde18440d05ff45163b953b0a67d63f9d1c6a2cb6a4fcf84da70a9caf097ca952ddfac457848c02502d5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    ce4c88338f9963a0db7bc0137a64e44e

    SHA1

    723be3ed293e1b307d1cbef67b27720c942d98de

    SHA256

    e7bce17bf1be8c02c56b72796f2fe0357085978f4b25dfd5d829bce900f26fd1

    SHA512

    efc5058291a702c16f3001f3c60922bed27afd32004fff79393268588b49f4349a54e57cd1fce6fd1d744f4211242cab9e76f67e4a4e05912fcdd103f63a9265

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\85y7ywt\imagestore.dat

    Filesize

    5KB

    MD5

    ad197acbf6d57b138ab7cc054d4574df

    SHA1

    d702b0c0b203b71f43d2e16f22670ba9fd6ec23e

    SHA256

    b161cc2b52d01aeecc9871cf09592b0b52d4817741f50eab377ef05683d0852d

    SHA512

    c7e5c75661e057d3a72ad1a767a152e67ea01f05d7d40894344662112a0856bed64ea6f6dc8367b093131cf73d7d7aa3ad61c76d2555a1e5fbc82ff485c7cc30

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J7FHNNOW\logo-ig[1].png

    Filesize

    5KB

    MD5

    b3b4af8425eda6457518445649562041

    SHA1

    75827102d9d5d610835ed4b1c25eb61506c3fa57

    SHA256

    e3b22a537e12467726b4e77539f20175c1effbf18f5910d77073dbb6ab1a71fe

    SHA512

    7cf18c9ffdff11d044dab89898cae82b4243e97b6e01598eded8578d62118fb98ae18b75fcc0c319c675c11fe83008a6114e8917e5de3157597835fb0f9214c2

  • C:\Users\Admin\AppData\Local\Temp\CabDC8.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarDC9.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Windows\SysWOW64\AntiVirus.scr

    Filesize

    7KB

    MD5

    f32040c3ea2b9a9689efc82d200d938f

    SHA1

    c0045d33954e427914df5008483e6055ff359606

    SHA256

    31928e35c6d85f22648c3e8e349e2b21570a207a35341003c4ca0c1393ab062a

    SHA512

    8c0b50790141cd2d809e3e8233237953291111b3c444e33a95fc7ec80e5b6fc2d9ad14194581a09b4c7c793358aade754c95bb33cecf41ed9c129470e4891811

  • memory/2604-16-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2604-0-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2604-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB