Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12-01-2025 08:25
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_0a037e53cc74c51d7b8bb46b68a1c3d8.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
JaffaCakes118_0a037e53cc74c51d7b8bb46b68a1c3d8.html
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_0a037e53cc74c51d7b8bb46b68a1c3d8.html
-
Size
143KB
-
MD5
0a037e53cc74c51d7b8bb46b68a1c3d8
-
SHA1
fa719b7faf5cec8169eb38c6e05846a99bbe7714
-
SHA256
4d8725d48c5a86fc1620aea2305da225ea06d5be8eb3985838637d20043b2307
-
SHA512
c171dbaa87f38d4db998c04d0fe034a0e21146b5700cf88ae7d85bd9814af21f94122872b505481be7d58029e156100cce195d0e03f8493eba274daa8bbb66c5
-
SSDEEP
1536:upUJECCOEGi8rdCkLnDD9BVZfkjnf5w4w+im:upw1EqdCkLnfVZfI
Malware Config
Signatures
-
SocGholish
SocGholish is a JavaScript payload that downloads other malware.
-
Socgholish family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442832206" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD05E531-D0BE-11EF-B5D6-4625F4E6DDF6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2308 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2308 iexplore.exe 2308 iexplore.exe 1708 IEXPLORE.EXE 1708 IEXPLORE.EXE 1708 IEXPLORE.EXE 1708 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2308 wrote to memory of 1708 2308 iexplore.exe 28 PID 2308 wrote to memory of 1708 2308 iexplore.exe 28 PID 2308 wrote to memory of 1708 2308 iexplore.exe 28 PID 2308 wrote to memory of 1708 2308 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0a037e53cc74c51d7b8bb46b68a1c3d8.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5c9be626e9715952e9b70f92f912b9787
SHA1aa2e946d9ad9027172d0d321917942b7562d6abe
SHA256c13e8d22800c200915f87f71c31185053e4e60ca25de2e41e160e09cd2d815d4
SHA5127581b7c593785380e9db3ae760af85c1a889f607a3cd2aa5a2695a0e5a0fe8ee751578e88f7d8c997faeda804e2fc2655d859bee2832eace526ed4379edaa3f5
-
Filesize
436B
MD5971c514f84bba0785f80aa1c23edfd79
SHA1732acea710a87530c6b08ecdf32a110d254a54c8
SHA256f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA51243dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD55a4fa07e83195da408c78128574d3423
SHA1ff10768d86da018aafa9ed949b9d1d3f97584ba2
SHA256139dcae0268929189c9530d101dbc25847d7b8a1ac1353e500e893989fabd4bc
SHA51261d0e1f37d61d5ce5739095fba200f4d333597a4244679459b009889ec8d924298f0813acec1f992a8a4db1a34d2b6ab4a744704e7685dad255c6831474fb4ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Filesize174B
MD5879f128e3391224726488658a6f36824
SHA1c57c2eb0f019a33a11394ea69ef1c21d386f06ea
SHA256ca630b617b4f872f3880562fa473a76a235fc140489c81da732b5c40e371edaf
SHA512861a7e0d161d7dbff8151de6d2986cdf10a5ae8ec384628ce64ab055478bb0830d1041ecaea4dab1e6f4c28a77a45c5c755a9141ff0cb24960bb13fc8f668c76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50aead1eb877605684870fbbaf47a5781
SHA128d48e0e92065d2895df4a4dc3579ae593c5e771
SHA256b58905c9cf00f5055c3cefdf25a08927d29c2cfd17d4721cbca58f1ad62fb4b4
SHA512390c97c75eca08bca2519c65bb51b4da5ca7b5ef58c6cafba9dbe402cd3fcc6e7705472778a0cd7bab1b3e1af47a4ef5e26d4c9d3cd27da1168afa489fe48e51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50474a029f85121c75c07c9347bbed545
SHA125d5c22c57d9ebb525e04c18d7ba8ddb14d963a8
SHA2564d95708c800a69ce0ccbc4e6c5f3674d75b134e7ce997689b6e011b2c1b08b1f
SHA512d9f9e91665ed775f3857aa0b9c9d3ea23f19ee2413a8b1f41d72e64460c25bbaca9ac2f95975d9d1de5db8783a25a408af4826f646a762ac0510dc6abb9ad051
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55adcce9d23333fb26326f2310d206524
SHA1131696592076e2c8ef6bec8562e10f2ef8712629
SHA2560c21ff86e27ead8840ede0cae24aa72b6ffbe94639a9fd122aff26a308608df7
SHA512f99a8cbcea52e8b1c2b78643021126228bd11307e59865a9a33e8b9250f3211e57f6c9144feddd0c5f14a0cbcba0580bb389055299cbb7027098b0156843fe63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52b019829eecd94019422568421b68617
SHA1a2406a5dc03ca63d667db876d2ca577eed11471f
SHA256d253d51706573c380c534c1cf68fffb5050675e456acf37107df0dd93bed1f8d
SHA5128af7d6c559f053709b42ccc1abbd590df8f99905cf449c25f78841d9d1950fb35cad8d21000deacbb7a640e05ee393650ff08f4a92409de9984869c84c8e1f8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b24a71433e16c433304b054fb6c9f1a5
SHA1a6adf0dcba2cf06d96f29ed4491e328ae95cb3dd
SHA256976ed697b9bef916c5e1ed60cea9368d31984e89842327f9b8b91ccb7bfdc10f
SHA512ac120d5af3b0f4f03235f3647d83f3548e12495bb776c9f77b08e7764673fa945f77cf595b40a29f3ada5be5f95089957270f3285cdf9e5d3986f54465dd535a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD519e3d04d31ea28eafba662b98079c6e3
SHA1ec331661673be65f3daba0567af9e17ebacc99ba
SHA2564878b95070773ac9f5d91410f49a94e90f348e21b5b59c1e45a1c9d830804a6a
SHA5125d38e5d2894ca608684a1ada9a2f949098c02a1a9a7e9e2442318959311eb92ede4d49fdaa69c5960b85c03ddd9959f8c56fedc3e459ff39192c138cdc4f9da9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD528fdbd871952a4492843d20170eb4c76
SHA15a76d44946eb03b06452f92cb430f8232de65ccd
SHA256768e25c9496a324ca1090bfcc4094a27ced6b9e6a06226b6956c79a72631724d
SHA512fd788469e0541742478554ef6c252dd7d481f616bb238b89d8095cb86b539e21aad5faa73478cb96925aab36fcc90650a8d32fe31428cc99717231d6e9da10a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52107efc262d01fcb10e002f0852683f0
SHA1513046981237f818aa0402f8aa562efa7a9d786e
SHA2564a36c361a0ba139bf5d464057b5fb2e2f0ea29f381595e14844f97a2fa03718e
SHA5124d314b4aa83987464969e8129f61d45fe1b1bc2776c77d41a62e2d2ac29432f9b8820dd925b30b2839558834751c265beb7e609a3c4d58d43001c2cd985c2312
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5669836c18d39fea21035a57ebf46e24f
SHA1992610ffe607fb12815c77863c286137fb95ad08
SHA2567d3117cf41732ee282ec271f41f68f9fbee5e6c92e8ce9938354460f7d265125
SHA512d455d1af071220996dab59b9d4e4b4b3405bd59c056e690a06957846bc1a1c675ff780f6987fba510fc571712dfc91e9406f1e42480d4782ec9bb1ed0a1f2548
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59ad8a7102c5cb0ee8fc56051cfce1b08
SHA150478edd517f1864db0ea670e585a96ce68f0c55
SHA2561f10550ab8de023aa951c1b35dc3d84da810c87989e3de663f833c2ac43bab64
SHA512c04c65c8feae8009d5adec1b99b62ed20bacfcaa16f903d9762f63bf558c658409d1161e511f4a1f69f414f3721508ef05483e359c278988d60d43eab3e739ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1e08b803896b3fb96c9357ccca910df
SHA1a3b2680fd4cf70653670c48b3d05a3b59f12c30b
SHA25638834225233e4e52da4daa1928c9f086669549f94336af9c0977131a2199abd8
SHA5126c91bdc1d8151bc47d6cfceebbe806a8cd2f73ec1b5870ef3403a1c4c0c2d493db789fe17de28f31eb11205ab8f03bc5732cbccbae5b9f543dc430948f0bd948
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD570ae894bf33f2113aad775a6b12325d9
SHA19ec9da51d6ce392bb9fadcd0a6124de761e250ba
SHA2563f2a8a76ff2d9e5f98387fb9ec338aa76e29645a7eae2ff1bff8956fd42ad92e
SHA512334bf82f503795edb3266672eaea8cd448a797dc7ad7b40c67eb7810c3f9cafe132b1ed6ac772e1d2bd273df54589575d59ee360e3108824c6b00c6fcc6c618d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5766ea6d4b4c5c39c6a57fd0b7e068159
SHA1c3f5f3a45d7a5ce7884502380124db236fb71410
SHA2568f3077b76209b7c98a85a8f744cac3d85d7ae126a861526c7447450e02493a93
SHA51292497da0fe3ad6b18210fd20ce63af1b30a2ee16b0e2f0123073450694f301a4cfb6ff13c0294a62e707671ef9635d33f25f54344314c42a8d4dd3e5955b33a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Filesize170B
MD5893e4c23706cbbcb52a0fac4b493b183
SHA18fd6747da3e0e5d884c8cf821ebacb886f54e0b9
SHA256a0eaf0c773cc000347886801387f8afea46da0936f6fba90f655c206c7c64c59
SHA5124ebb1d8ea09885f94285659d99cf4092ba3724d58b3228862ced16a475f477ce1918168e229f6891bc6d74dd6ba20fa5c0fd9adef81d97a6178fbfdf0e9db5d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB
Filesize396B
MD5adf700a616368b70a5d6f913ce4d5f1b
SHA1aaee16c0a2658f28505dd686f4c2c15f33ebb9dc
SHA256abdd8759fa313a659b62c3f1ce8c199e305ec3c254028e9c77107bd6f4c6fd4e
SHA512645807e7174cb9b955c8150658bfa33f5bcf3aaf4d9c850b822117e884159375bb736fd870d73ad94e79516d96b6db0b6fad8fe8f8752131e46d4283bdf32487
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD54b189e6c4d839924fa71f0647f753701
SHA187fb83cc70f12d764679955232a02147e33483ab
SHA2568eff4fd60ee9385c85d6518a53aa57c5f59c856c6ef7c05610d9c0294532adde
SHA51228ac59565862be834d0ea4cfec3c3af53b167b84977f6be6c58a5f670394c2ab8fe9a6eabcbbc70fce8398d90a180fc87c319afe15004a0d6d354d7090f56074
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\f[1].txt
Filesize44KB
MD57d91634c33c08b3873ac18b6f2a61d36
SHA1146048b7631db3c5c93d601d505f4b1e4b419d62
SHA256762af03954033aac1217c5a9e5573f1636fb167ca9d94b930f864e1921b08dc8
SHA512bae7a0c4851a337803db8f945775649dc5e66c16cc39e2ba40394a3dd734ce9820ccb4718dfbef1b257cf58a2d6a3c2fd01cecce18cd61da84e3d3f0cdd1bdab
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b