Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    12-01-2025 08:25

General

  • Target

    JaffaCakes118_0a037e53cc74c51d7b8bb46b68a1c3d8.html

  • Size

    143KB

  • MD5

    0a037e53cc74c51d7b8bb46b68a1c3d8

  • SHA1

    fa719b7faf5cec8169eb38c6e05846a99bbe7714

  • SHA256

    4d8725d48c5a86fc1620aea2305da225ea06d5be8eb3985838637d20043b2307

  • SHA512

    c171dbaa87f38d4db998c04d0fe034a0e21146b5700cf88ae7d85bd9814af21f94122872b505481be7d58029e156100cce195d0e03f8493eba274daa8bbb66c5

  • SSDEEP

    1536:upUJECCOEGi8rdCkLnDD9BVZfkjnf5w4w+im:upw1EqdCkLnfVZfI

Malware Config

Signatures

  • SocGholish

    SocGholish is a JavaScript payload that downloads other malware.

  • Socgholish family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0a037e53cc74c51d7b8bb46b68a1c3d8.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2308
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

    Filesize

    1KB

    MD5

    c9be626e9715952e9b70f92f912b9787

    SHA1

    aa2e946d9ad9027172d0d321917942b7562d6abe

    SHA256

    c13e8d22800c200915f87f71c31185053e4e60ca25de2e41e160e09cd2d815d4

    SHA512

    7581b7c593785380e9db3ae760af85c1a889f607a3cd2aa5a2695a0e5a0fe8ee751578e88f7d8c997faeda804e2fc2655d859bee2832eace526ed4379edaa3f5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

    Filesize

    436B

    MD5

    971c514f84bba0785f80aa1c23edfd79

    SHA1

    732acea710a87530c6b08ecdf32a110d254a54c8

    SHA256

    f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

    SHA512

    43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    5a4fa07e83195da408c78128574d3423

    SHA1

    ff10768d86da018aafa9ed949b9d1d3f97584ba2

    SHA256

    139dcae0268929189c9530d101dbc25847d7b8a1ac1353e500e893989fabd4bc

    SHA512

    61d0e1f37d61d5ce5739095fba200f4d333597a4244679459b009889ec8d924298f0813acec1f992a8a4db1a34d2b6ab4a744704e7685dad255c6831474fb4ac

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

    Filesize

    174B

    MD5

    879f128e3391224726488658a6f36824

    SHA1

    c57c2eb0f019a33a11394ea69ef1c21d386f06ea

    SHA256

    ca630b617b4f872f3880562fa473a76a235fc140489c81da732b5c40e371edaf

    SHA512

    861a7e0d161d7dbff8151de6d2986cdf10a5ae8ec384628ce64ab055478bb0830d1041ecaea4dab1e6f4c28a77a45c5c755a9141ff0cb24960bb13fc8f668c76

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0aead1eb877605684870fbbaf47a5781

    SHA1

    28d48e0e92065d2895df4a4dc3579ae593c5e771

    SHA256

    b58905c9cf00f5055c3cefdf25a08927d29c2cfd17d4721cbca58f1ad62fb4b4

    SHA512

    390c97c75eca08bca2519c65bb51b4da5ca7b5ef58c6cafba9dbe402cd3fcc6e7705472778a0cd7bab1b3e1af47a4ef5e26d4c9d3cd27da1168afa489fe48e51

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0474a029f85121c75c07c9347bbed545

    SHA1

    25d5c22c57d9ebb525e04c18d7ba8ddb14d963a8

    SHA256

    4d95708c800a69ce0ccbc4e6c5f3674d75b134e7ce997689b6e011b2c1b08b1f

    SHA512

    d9f9e91665ed775f3857aa0b9c9d3ea23f19ee2413a8b1f41d72e64460c25bbaca9ac2f95975d9d1de5db8783a25a408af4826f646a762ac0510dc6abb9ad051

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5adcce9d23333fb26326f2310d206524

    SHA1

    131696592076e2c8ef6bec8562e10f2ef8712629

    SHA256

    0c21ff86e27ead8840ede0cae24aa72b6ffbe94639a9fd122aff26a308608df7

    SHA512

    f99a8cbcea52e8b1c2b78643021126228bd11307e59865a9a33e8b9250f3211e57f6c9144feddd0c5f14a0cbcba0580bb389055299cbb7027098b0156843fe63

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2b019829eecd94019422568421b68617

    SHA1

    a2406a5dc03ca63d667db876d2ca577eed11471f

    SHA256

    d253d51706573c380c534c1cf68fffb5050675e456acf37107df0dd93bed1f8d

    SHA512

    8af7d6c559f053709b42ccc1abbd590df8f99905cf449c25f78841d9d1950fb35cad8d21000deacbb7a640e05ee393650ff08f4a92409de9984869c84c8e1f8b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b24a71433e16c433304b054fb6c9f1a5

    SHA1

    a6adf0dcba2cf06d96f29ed4491e328ae95cb3dd

    SHA256

    976ed697b9bef916c5e1ed60cea9368d31984e89842327f9b8b91ccb7bfdc10f

    SHA512

    ac120d5af3b0f4f03235f3647d83f3548e12495bb776c9f77b08e7764673fa945f77cf595b40a29f3ada5be5f95089957270f3285cdf9e5d3986f54465dd535a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    19e3d04d31ea28eafba662b98079c6e3

    SHA1

    ec331661673be65f3daba0567af9e17ebacc99ba

    SHA256

    4878b95070773ac9f5d91410f49a94e90f348e21b5b59c1e45a1c9d830804a6a

    SHA512

    5d38e5d2894ca608684a1ada9a2f949098c02a1a9a7e9e2442318959311eb92ede4d49fdaa69c5960b85c03ddd9959f8c56fedc3e459ff39192c138cdc4f9da9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    28fdbd871952a4492843d20170eb4c76

    SHA1

    5a76d44946eb03b06452f92cb430f8232de65ccd

    SHA256

    768e25c9496a324ca1090bfcc4094a27ced6b9e6a06226b6956c79a72631724d

    SHA512

    fd788469e0541742478554ef6c252dd7d481f616bb238b89d8095cb86b539e21aad5faa73478cb96925aab36fcc90650a8d32fe31428cc99717231d6e9da10a0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2107efc262d01fcb10e002f0852683f0

    SHA1

    513046981237f818aa0402f8aa562efa7a9d786e

    SHA256

    4a36c361a0ba139bf5d464057b5fb2e2f0ea29f381595e14844f97a2fa03718e

    SHA512

    4d314b4aa83987464969e8129f61d45fe1b1bc2776c77d41a62e2d2ac29432f9b8820dd925b30b2839558834751c265beb7e609a3c4d58d43001c2cd985c2312

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    669836c18d39fea21035a57ebf46e24f

    SHA1

    992610ffe607fb12815c77863c286137fb95ad08

    SHA256

    7d3117cf41732ee282ec271f41f68f9fbee5e6c92e8ce9938354460f7d265125

    SHA512

    d455d1af071220996dab59b9d4e4b4b3405bd59c056e690a06957846bc1a1c675ff780f6987fba510fc571712dfc91e9406f1e42480d4782ec9bb1ed0a1f2548

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9ad8a7102c5cb0ee8fc56051cfce1b08

    SHA1

    50478edd517f1864db0ea670e585a96ce68f0c55

    SHA256

    1f10550ab8de023aa951c1b35dc3d84da810c87989e3de663f833c2ac43bab64

    SHA512

    c04c65c8feae8009d5adec1b99b62ed20bacfcaa16f903d9762f63bf558c658409d1161e511f4a1f69f414f3721508ef05483e359c278988d60d43eab3e739ef

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b1e08b803896b3fb96c9357ccca910df

    SHA1

    a3b2680fd4cf70653670c48b3d05a3b59f12c30b

    SHA256

    38834225233e4e52da4daa1928c9f086669549f94336af9c0977131a2199abd8

    SHA512

    6c91bdc1d8151bc47d6cfceebbe806a8cd2f73ec1b5870ef3403a1c4c0c2d493db789fe17de28f31eb11205ab8f03bc5732cbccbae5b9f543dc430948f0bd948

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    70ae894bf33f2113aad775a6b12325d9

    SHA1

    9ec9da51d6ce392bb9fadcd0a6124de761e250ba

    SHA256

    3f2a8a76ff2d9e5f98387fb9ec338aa76e29645a7eae2ff1bff8956fd42ad92e

    SHA512

    334bf82f503795edb3266672eaea8cd448a797dc7ad7b40c67eb7810c3f9cafe132b1ed6ac772e1d2bd273df54589575d59ee360e3108824c6b00c6fcc6c618d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    766ea6d4b4c5c39c6a57fd0b7e068159

    SHA1

    c3f5f3a45d7a5ce7884502380124db236fb71410

    SHA256

    8f3077b76209b7c98a85a8f744cac3d85d7ae126a861526c7447450e02493a93

    SHA512

    92497da0fe3ad6b18210fd20ce63af1b30a2ee16b0e2f0123073450694f301a4cfb6ff13c0294a62e707671ef9635d33f25f54344314c42a8d4dd3e5955b33a9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

    Filesize

    170B

    MD5

    893e4c23706cbbcb52a0fac4b493b183

    SHA1

    8fd6747da3e0e5d884c8cf821ebacb886f54e0b9

    SHA256

    a0eaf0c773cc000347886801387f8afea46da0936f6fba90f655c206c7c64c59

    SHA512

    4ebb1d8ea09885f94285659d99cf4092ba3724d58b3228862ced16a475f477ce1918168e229f6891bc6d74dd6ba20fa5c0fd9adef81d97a6178fbfdf0e9db5d3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB

    Filesize

    396B

    MD5

    adf700a616368b70a5d6f913ce4d5f1b

    SHA1

    aaee16c0a2658f28505dd686f4c2c15f33ebb9dc

    SHA256

    abdd8759fa313a659b62c3f1ce8c199e305ec3c254028e9c77107bd6f4c6fd4e

    SHA512

    645807e7174cb9b955c8150658bfa33f5bcf3aaf4d9c850b822117e884159375bb736fd870d73ad94e79516d96b6db0b6fad8fe8f8752131e46d4283bdf32487

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    4b189e6c4d839924fa71f0647f753701

    SHA1

    87fb83cc70f12d764679955232a02147e33483ab

    SHA256

    8eff4fd60ee9385c85d6518a53aa57c5f59c856c6ef7c05610d9c0294532adde

    SHA512

    28ac59565862be834d0ea4cfec3c3af53b167b84977f6be6c58a5f670394c2ab8fe9a6eabcbbc70fce8398d90a180fc87c319afe15004a0d6d354d7090f56074

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\f[1].txt

    Filesize

    44KB

    MD5

    7d91634c33c08b3873ac18b6f2a61d36

    SHA1

    146048b7631db3c5c93d601d505f4b1e4b419d62

    SHA256

    762af03954033aac1217c5a9e5573f1636fb167ca9d94b930f864e1921b08dc8

    SHA512

    bae7a0c4851a337803db8f945775649dc5e66c16cc39e2ba40394a3dd734ce9820ccb4718dfbef1b257cf58a2d6a3c2fd01cecce18cd61da84e3d3f0cdd1bdab

  • C:\Users\Admin\AppData\Local\Temp\Cab90CD.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar90D0.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b