Analysis

  • max time kernel
    120s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    13/10/2024, 16:53

General

  • Target

    41014f068ebb58f18c8b8e9598981dc4_JaffaCakes118.exe

  • Size

    497KB

  • MD5

    41014f068ebb58f18c8b8e9598981dc4

  • SHA1

    c1f9cda3b7b4be0ea1413c3174fc3c0ffc40a854

  • SHA256

    e167a40c3d204d9de694a5fcb54d5d7bd83b3eec37abf1c07bdcc18d82c73d19

  • SHA512

    ee389b38aff0bd5b5af3f1cacacb309aa2ebf7d83d5b7d778abf46cde54a6f5eaff6e97a5c99028531751caeb9f001aa0df7b754ce974d9e95e90504aea6b9f9

  • SSDEEP

    6144:ee34R2/3/zh36dqXEVTrnCRZG/t7FTBqTzP7n7O7L6K2Bfo7pr:Q2Hzh36VVTGf0ZTsnz7O7L6ju7pr

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\41014f068ebb58f18c8b8e9598981dc4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\41014f068ebb58f18c8b8e9598981dc4_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2888
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://pf.toggle.com/s/3/6/36143-93568-milkshape-3d.zip?iv=2012101812&t=1728838439
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2980
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2344

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a809234f98c4b093f57666a5e1b19b07

    SHA1

    860472532f6252343d00167d7c7ea57d8bfbd9d8

    SHA256

    bb6858219ac2a3319f4d001cb866892b81ef6848f61552cc043177f2de705ac1

    SHA512

    748e960a32718571d7c2a14e1a9b8aab24abe1daa6a3d6fce911ed87d431e5b1925de90e3fb453b2f714fce99c4a1850e3247420c3fd8d3f92970009ad6ab07a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    233db77386c394a445bd9b5763965537

    SHA1

    852b035cb724492b0f5da67aa455a035d4b8b070

    SHA256

    d0aed709f9597cd095f44ee96dbe5b1a026ecb0d0791906098f310be518c32b5

    SHA512

    69cfcbb72814dfed141fe74e416878ab848fcefaa37417dad925938848393abb05dde9ae0487abde5c61d3482d98bdb156937783ea1aa6da533cf9e0c181ec12

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    aff8db3ecdc3f6ef975c98f4d11c6ca4

    SHA1

    a6382268db4ab127b4b5637a7da330bb4f5ad3f0

    SHA256

    6eddab70fdac4d8008f0ede4146bbc1b92b977e13aaa6d695c512d7da3731fcd

    SHA512

    e2a9a432c5a721f9c3d573dce15d2673e752ccad5df5ab16b3debb8ad3d86c54343f06a96c1fea7f25ebb7bbc46c80a2bc79cc9e65f2732b71839dfdbd19f4f1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2a0b7da6026d62ad53235ceec5534b22

    SHA1

    c84e19d6c7bd62536d196ec49f1b7e1afe439eb2

    SHA256

    18cdfefda1690bab35b42ddb44cbf935a0446822ff1c0f0a8bf6abc89fff466a

    SHA512

    f8e53bde3d853dfabc7ccd8411f657d833ca1a293a2dd4f695f60eceba171a286b3d54321f1cf64323cd57cb121bba3b4fbf89ce4ba03f43f90fc5f46d2d262f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    27d03c9099413fad9be27a45b8c2ad97

    SHA1

    b00abef6121fd41a5c913064ffcf6e3058935c54

    SHA256

    5098769f2c5d5b4c0b70eb05c870971e00e28263aaba1961b9ed5b9abb90e0ff

    SHA512

    16a1e91887bdf75409cd01c491fe3bf0fdfca17eb3d5df2cb6191a7dec3c3d00c09451372ea1693b1bfedb0f0c431574cfbee10226b3d4734ca23d3738b8f3e7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    dbfec39d741f74e683a10fc387890f6c

    SHA1

    54c56255a984a5a82151743d0b18881ae0fb0ec8

    SHA256

    192240d7e662fd1e9cc504145f97712037200e15209778c8d65f7468e646ec5f

    SHA512

    397d2dc6c0c7fadd7ceedb749d05a1cd0048543deb77dde793d001b3180912e5537370d2f4f8bfd3468f37315bbf07156d2b8cdb3a92cc31e84fce47eba3bb1f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e663681271b092cb6ee7cf5b7d8d2517

    SHA1

    f5cc1cddc781a56282606c85d0069a7d9b27ecbc

    SHA256

    192c0821f1f68c5b50606e1cebc7fff6c1477ffad7fe4b9b1b5718ce31466736

    SHA512

    294cf00870d88643b7d9e4340b8b061c986be1afb3b74d9411c0e3c71055bea0157d1b9f8bec81861ceefee6711385d1403818047bebd86105ca09733644e414

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9e7397dbc54913536d54cdcc6a002934

    SHA1

    80b42ff6c0d1af330af3a4187fd8bf9183508070

    SHA256

    00be8272acc7e98417c6c64475ae095d0c34ec7b8bf2559bb6a01823026cdb5f

    SHA512

    d4b370cfa2cec0dc7d3312acfd208929032d26b1e8a16b7fc20c72dfeb5d51ba58a81443c31e6c2ecb82ed3309bc223f90289663948b6c6fe50f4a0bb5e4c7df

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c4774d2459dff9e17451cc345eda5087

    SHA1

    3eadfd65f20b8845996612627ffadfc742a5da0e

    SHA256

    6705bf2a05e81f28fb4c57eefc2a2af61a96d442709a47a4b7bd9a1e515d9cd8

    SHA512

    2f5c81c75b409851636ea57804ad77d9a7314aff2332de970a0a2264da48fc68ba34534ee484cd4544e296df640c22405077a6b804fbd3573e0cb7a9880a2836

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f2549138a4f425f7402998b4e364d969

    SHA1

    3c44a07f76ceb745377ffbb5462b19dea3aa4e65

    SHA256

    7d448ff4314772e214158dbd0a115bfa61721b5354694415296eaf5793ae9e17

    SHA512

    626db78c2a3cf8ff591cef272dfef964340d716f201761ddb3fdccbb866b1df5ab38c1fe7f71e294101c473ed81b9a9184f1e72d5e8fb273d1c93c486a0f3a21

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    005048d4bf001c9eb983f8a5287aeb19

    SHA1

    35da47c85bbb27f801ae66a4b960afe3d51c9e89

    SHA256

    f4fdec11b12e8d7a525c60024f27e0e4d4b4d939aa4687650b5cc8049eb667db

    SHA512

    50199fab6954ad9c4cceacf460d7d103e2faa69d7bed834ce2ca13af7308644b87c9e9ae2f655311b297cd5e8e2e17cd6b7736fd4f0886b92d6464d8c177d306

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    91a17e3f1e3f7026899321bd72cac725

    SHA1

    3a4e5921f4b2bea0bed1e32d4e7b98eda0305676

    SHA256

    ab727dfc1c535c9335aed18f1d48ebd7a0b4f4de3393c564b7dcf2b7be645ff7

    SHA512

    84e778bc4f94488eda941a10eda8bf51ceab7dc7353e0a246a0288d36b84fdbbaa5e0271468edc142af6a462b244eb1d71aefb07dc098fd2794cc5494711a3ea

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    74525003b41b96f0de16f3aae09b77aa

    SHA1

    0d8d0df26900a51be08216259658f21f0f0d74aa

    SHA256

    f3e38b4f57021172576e320b6baa31bf35346c31cfaed237cf40d35446db4b0c

    SHA512

    52f54632c4434584e173bdb7eae263c00733f870b570a099b6bffee21b6e4e94b8004bce409ac36cea49acfc8406998a53afbbaf9146f91e240572ed6afed8b3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c59aa9796573ca116b31db385a8c42d0

    SHA1

    4b8e0987b2e614ac93414885c04a2fb11fdac3ef

    SHA256

    1c92487508db059aa3c74123ad1f8e970c7d1a46c03968c41c0f9d6decb6be23

    SHA512

    9051257a327615eb5c5903defecb530d0cc7024673651edec43d184009f19f4cedef9123fc89ef969901572daac0878dd3569a86ac752ed289ead636aa8775cf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b2dcddc00b701e1e5151e1157e502b4f

    SHA1

    ff908dc4ef14fb316b6c53be8f9fdef0d3be2d49

    SHA256

    06acbac0279e768714837f9b5b5c1dbd28186400fe6b08523a3dc6ec8dea715a

    SHA512

    4f4a5ba7305fb128de9d8c5ab15ff3d9a67f819ef0043590968248ac79d5aed8f1c65896fc6ab4e0e9eb2c1ab48d7b98fa325110c43ea7d3506bf3ba9145ac44

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3617fbfecc3ca82e8490b4c8cb29976c

    SHA1

    fbfa5bc78485a4d745f10e69bd857a3403db907a

    SHA256

    c18e6422aa4437cd698a902e26f53a9c4f70d60f28cb1e2795fe353819435575

    SHA512

    87e331e85bafc3a89d87bab1aac92c1ddee822ba4ace48bebddcd3395caf4a6b481b42f164370e7913d79f8cb1897761cc92de3e118cf8d82e6c3c81950daf38

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c9c43271bf1f445d44ec76d3276db584

    SHA1

    5941066eb29159d0e1eb3677f4800f45df7021ae

    SHA256

    2dc9859ced2a560975e8aa10dbab7b415107b8a623a6065cd2591644ea4ebcb6

    SHA512

    f0fb9b0e07b3d98b08123b2a1affff4a976ca70f93a57174797d1ef27cf50b5e824d2b6734234793253148d4a7e11f0e496ffa565a50e81117d5379162b1f6ba

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    86179bdcd431c6817082ebd2803d195e

    SHA1

    f73c56104f162e329041d885474a8892f9d39842

    SHA256

    1ef09b46253f91884148c789c100bd50ec24bd1ea67f78b388e1a1c78a5947fb

    SHA512

    067cea03656c102ff942df729f62f3d2fb2f39be8bcfd94b14fab93311849e170834f657f16ca5e12d1bded9e5b75826c2ddebba164b6c8847cba998d5ccc075

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    662a0d27b4e7c8d6a9ee785b63deb7f9

    SHA1

    f9b85249a76efa95066e133fde09245f0740b145

    SHA256

    6363098711d89f605856542ce703ff935f53bf26a3e02a38345376a279411c95

    SHA512

    939d59da00d59e0ee254bd01003d68e1d60451bab135e2e395171693a055837183c509d66ff4d63934e36093b9a38971df46fb0e9e96a0ea64b2059e5e2a950a

  • C:\Users\Admin\AppData\Local\Temp\CabB58C.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarB64C.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\nso64AD.tmp\ioSpecial.ini

    Filesize

    398B

    MD5

    d7092ea39c61ce4a982a18e48af96815

    SHA1

    42e2a565fcdc7260d9209fada870de014bf71a04

    SHA256

    73597ee8d3695f7682367254556b3c354d599611a4df002051e2fca363c9ce30

    SHA512

    536959f667cd5d887a2b998c2e6f930b59d573bc9ba4bf5390970fc58b55634c8e292d6c9559718ecfdf91ebc3d3097ad813d5abf19ed7f1c60cc1b957fcfe67

  • C:\Users\Admin\AppData\Local\Temp\nso64AD.tmp\ioSpecial.ini

    Filesize

    1024B

    MD5

    e0938b0d22e0d1c9d1701c02a25ff3b4

    SHA1

    e9a454c4a91e5046d5a445ff7fe8bd28dd076b26

    SHA256

    58e6296035f3d7a91cc0201523550535a0426f5f6dd3581f553c3e90d424f92d

    SHA512

    802b4f2a02a2da89a4410002b77882a9a6a69b512682afe82aeb303e26c5c13098eaa8ed4f028426be1f2231a702e932839231c2daf1f8d0a02f920436f90276

  • C:\Users\Admin\AppData\Local\Temp\nso64AD.tmp\show_page_toolbar

    Filesize

    1016B

    MD5

    de86f93cee23f29c4146d0490847826f

    SHA1

    cd01e4525e6b2cb3e6ced0589af4be9c2d0a0826

    SHA256

    b7b742ad61715e695a56cd0d1735d969bc7fc2c68899d823fb3ccc677a966ceb

    SHA512

    3b00c9aa5f3286e963c0ab8e3a827d7382d847ec68313f1a40088d68d0f6eeee61d6a56edc8c45f0a963c80afc9233acaa6fe75123887647ea88ba1aa9222565

  • \Users\Admin\AppData\Local\Temp\nso64AD.tmp\BrandingURL.dll

    Filesize

    4KB

    MD5

    71c46b663baa92ad941388d082af97e7

    SHA1

    5a9fcce065366a526d75cc5ded9aade7cadd6421

    SHA256

    bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e

    SHA512

    5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce

  • \Users\Admin\AppData\Local\Temp\nso64AD.tmp\InstallOptions.dll

    Filesize

    14KB

    MD5

    325b008aec81e5aaa57096f05d4212b5

    SHA1

    27a2d89747a20305b6518438eff5b9f57f7df5c3

    SHA256

    c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

    SHA512

    18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

  • \Users\Admin\AppData\Local\Temp\nso64AD.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    9384f4007c492d4fa040924f31c00166

    SHA1

    aba37faef30d7c445584c688a0b5638f5db31c7b

    SHA256

    60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5

    SHA512

    68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

  • \Users\Admin\AppData\Local\Temp\nso64AD.tmp\NSISdl.dll

    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

  • \Users\Admin\AppData\Local\Temp\nso64AD.tmp\System.dll

    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

  • \Users\Admin\AppData\Local\Temp\nso64AD.tmp\UAC.dll

    Filesize

    17KB

    MD5

    09caf01bc8d88eeb733abc161acff659

    SHA1

    b8c2126d641f88628c632dd2259686da3776a6da

    SHA256

    3555afe95e8bb269240a21520361677b280562b802978fccfb27490c79b9a478

    SHA512

    ef1e8fc4fc8f5609483b2c459d00a47036699dfb70b6be6f10a30c5d2fc66bae174345bffa9a44abd9ca029e609ff834d701ff6a769cca09fe5562365d5010fa

  • \Users\Admin\AppData\Local\Temp\nso64AD.tmp\inetc.dll

    Filesize

    20KB

    MD5

    50fdadda3e993688401f6f1108fabdb4

    SHA1

    04a9ae55d0fb726be49809582cea41d75bf22a9a

    SHA256

    6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6

    SHA512

    e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8