Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-02-2025 05:52
Behavioral task
behavioral1
Sample
JaffaCakes118_fffd99e8fbb30cc91081b6ec0a6b98c7.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_fffd99e8fbb30cc91081b6ec0a6b98c7.html
Resource
win10v2004-20250211-en
General
-
Target
JaffaCakes118_fffd99e8fbb30cc91081b6ec0a6b98c7.html
-
Size
99KB
-
MD5
fffd99e8fbb30cc91081b6ec0a6b98c7
-
SHA1
908801e3ab0813010b3d7f427a2d9d2ec21d38a8
-
SHA256
440837ebce0aefbb0817c0bc6b1896170e76be42d20759afaeb5d764d2be6315
-
SHA512
0a21e16ea954bf8e193d4d4e7dd2058947ab575e949ba2c3c3d92eaa0491d7277a64e28bcb7633f88e49b28cf07ce3ed8362a3a818c50585c2234ab35f89cf3b
-
SSDEEP
3072:0gpodXhXUodXhthvj8GnpI7MMj2M8cmC24gDtsr:Kj8QpI7MMj2M8cmC24Dr
Malware Config
Signatures
-
SocGholish
SocGholish is a JavaScript payload that downloads other malware.
-
Socgholish family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 202c672b3780db01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000061e3318da93fc42a1b248314232ae5100000000020000000000106600000001000020000000e0fc9cda76cdb88947e662a3cbd1d7ced014d97169218888809ac8a23d6330d0000000000e8000000002000020000000767464bcbd8244b6f3629acadb518ab5e0650ae165ec671dd191ca984906131c90000000b52fe6e02b9910ca6140e61ceee183ce2b05782485a909f3acd904c256e446143904860e735672d26f886219733208e1cf8884c0a32558a123c4be4beddffd572219b97045ac4d332412267bf84f3a3ed5efa8fb44751da02403f5f4711e62f646c79aaf0cb7de9d3bd0890db929520d5ad9dc7f5d434b447d62f4c86765d0c59f9357d61a11576759644aa2a423079a400000002d2367650f761e2dc8c2c56ede05a19957c6d31aaac378dde204c4e972b092b5d2c35130ff82e2029415afa4f1408a945eb8eaebf8224ebc97864f8516be8d2d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "445847042" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000061e3318da93fc42a1b248314232ae5100000000020000000000106600000001000020000000b4b2450f511e5b5096154ed6f52f9ee93bcd09db101262c17db2a8e0853847f8000000000e800000000200002000000054536b7c418bf4c081f6be23c02f884572ed3962f32998b8396e06f7be3ab2c120000000d78568e15b480b166ec5b0daacf38ef635ff91d542c19e87f7b6b53b2b013d2540000000a9ddb5e2afd7b02847656c1108724c465b00e3309665af1182a990fe86b0df06e28bdbc4782aa09256103041ffc259f3b33736cd473344e57f76e6f59ed47518 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3030D171-EC2A-11EF-97EC-7ED3796B1EC0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1148 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1148 iexplore.exe 1148 iexplore.exe 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE 2248 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1148 wrote to memory of 2248 1148 iexplore.exe 30 PID 1148 wrote to memory of 2248 1148 iexplore.exe 30 PID 1148 wrote to memory of 2248 1148 iexplore.exe 30 PID 1148 wrote to memory of 2248 1148 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fffd99e8fbb30cc91081b6ec0a6b98c7.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1148 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2248
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Filesize230B
MD56333e0bd758a87bc2d0b758b442ff869
SHA18ce041cfff41a211a54c6fdbc71ae866da3f3fae
SHA2561dfce1225c797183847bff046646ef93da9eaa18d978ffc2706ad2c4dca5df0d
SHA512669c01040f6e1b31e2a7d4975becfc47704452fecb628857e9a2ac53e23e36588da0c6e262b39aa68b1333689356c6e2ca92455d3dc7ce7575625ae8745fbb81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3e2d7a64e3fe5e762171104c3df8376
SHA1ff38d1157d469cdca190bcf614090ac7c3314162
SHA25698447392401559a412739a537780dfb268fc2bb50037acc0c480f69868998200
SHA512e904c5bc976ed8ffb4af297fcfd1a9c0e1a76cabd419948a77d8e8f51a483a0392ee7efdb780acf31ca7e76f371cfabf75da081991543ec6b2e8ebdeac706e48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD554678e9945b572e7234c0bd6f8152613
SHA116fc68eef1dc9e2c169e859321b4a19cb16b886f
SHA256f50e2bc02caef9668e7f3a773048400f1f8e2d1cababc8fbf0bc6628505c35ef
SHA512768265de89a174109b4a32238114d869df12dcbb9375f353257625b4df38724b65b82c61a6985e01942bd0c78dc719bfd61aedf690661015b1ad3e936980da60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD557f8bfef911c108e836d914f9e27a6f3
SHA141ae3b08ebd8f757ef1237c1eaa89e315247654f
SHA25612726e9210ac9a68bf5d86cdee109d075b5df9c6ad25754d413bc34e2f4b8029
SHA5123aa69ed6fffd3da0da41f68e0b405d16eb0bcd0b55b7c614be4b2f66fc83ad74c1c7c10a7c62f093f38b3d97dbdb8016cf065193061d7696da10eb1d92536b13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD547787424eb75a58fc2c935172d2e3936
SHA1e5601540f8a4c134c0685c7c7d1f201a077efa04
SHA25676835700ec523c3639fee70ba602e193df7b0783f91685795352121c5b9555ac
SHA51205e6949dc8698f44a844a9c153f4d8a5083f4f2d9feec7dc4eb082fb727ac05b9568afb18a9e51bf499a95b13e2ca826d99c1016d118b576e6d323a01e2ca502
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55cceede2741e5084b628eac67c80d605
SHA13094d63315b46845b6e417b8b5da2ed4734a83bd
SHA2568956438280311c47f8445e67c4fe1ecabc4b4cdbaf4bb4012a04ce447577036e
SHA51225ffebdddaec630836dbe17b88a7169fc096ff60bd8dfe795d92fff7d00d607cb3a13e11b246748fe6881ff9b97b72616681db496e75384a39c1753aad288fc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD521598327ed63f5b65a4ed83f976bf535
SHA1547ada53d09c0470cdbee14a45268eefdbae0037
SHA256e3b8f569becd91f81831d38366b44ec1d2e3524e1f393aecaa359056b9b1d55d
SHA5127e5c9d48c85155a72e9fdb3b0ab6d946d6e3af71a45102a508830307000762ae07a828103836d39f9c6703eba7124cddef994609c048fadd3ead4d242d485885
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57717494b6452bd290e2e9fa9cf907766
SHA1c1bc1b699e0ef852e675ea549bbda454ffe9f355
SHA256e014afb82b4c8e1233bd7b028fbc489b063f4bb6591b578bc0bd599156f258f0
SHA512c0bb689e94a8243dec34817cea3202ea293ad9776f854cacfa0d83a517aee8a7d2cba1ca17b8dc0ef38d70f2e4188e86345f6e1da22def51549930ef14063a10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a446ed259ddac77e2b062c3473b58b0
SHA1a02942a59df66d7e1c0973d3196ea48991b3dae2
SHA256a6e8d00cc4d108d925315109f20125d8430e958bcd95acc7d145dd5c970fffbc
SHA5126765a65740f5f5aedca407d713e222c4ff54ee0ce868b6d444fcd3c04352fca3757d4625defed4f68aea97b0ef0a4d8e9b726fbbb3fb625ca723d4c89b635c01
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd2db46c4d30a40f3762fc0015d7e23e
SHA1a027cc42fd7a426f577f7468723cc5e551a65b66
SHA2564810a78aebd6ed386e6de6cee0505433c7ced355e69b1d6547430d483107a238
SHA5126e8d4027bc44bcacf803f11430ccc276d931a2a9bf8b90782eb5e9c636a47f807e3c237929c7aed71c722700210128df8b7da754b161f2eab664e482a396b388
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555f9b75fb9f5068dd6c7b4115a869c37
SHA106f490552d82d7832439fc0082468a613377e4dc
SHA2568a8c61eb88ddf680989ed2dd17440a715a6bf8e98493db0f5881cab057712eb0
SHA512918f554d01df2d10fa3d4c1e0f7f8e4c251d377b16b52102aa27018bd0cbabbfb8d56e8bf4ca47b9232b1ccaef0dd5475b539750907f5c142c474261f2e9ac62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5309905b0c93bf9124b6cd166f32bde70
SHA1b98d6da776738c1e01695aafde87745f91b23f1d
SHA256abf530149791962e8dddeef9ea92ace7ea00f95f288ccb19476dac61332cb155
SHA51243466b2082bcefe0e91e9582f7002bebb82025ce85263395a08535ec80ed297cb46a6c6fab8eab7a006776421ae9abe8528ec7e7760244863afd7559987971b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fbb1392f7b6bd522b35f48991854f61a
SHA12bc148cc2cac2bb99034a366ba83e864abaf5c55
SHA2568fd9f6da9091813d5d976cb1bd5d0ddca0be5ace2f41e53f9056ef42c5430210
SHA51205349c2c968cc9a7c85d35508987fbdc537db9aa5529991b7d7de2e3142d9359d390fabdc7b1cfca0e57953a8727fa2ad387aa1e943bdafcdcc7730cad340712
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50aacbc0bf5f96aafff80b53a579cb187
SHA1c769a2a7c4e5b55cebab8ef9c18f4dfcea32deab
SHA25608f93b924c8e36d3ec20deb3fc9cda41b6f8eca9fa2957c8fd53a46edb1945c5
SHA51275f5df63716b7f05d73ca48e271d764d1d4d7b2fd69e6f790b94e2cf4886b94380cad2c874229126dcca6bb9fd7e36d49eff18f8f39e2f7a99477f7547f14fef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD598abc3ea16e92363d4e8f61b616a2bcd
SHA164c3b99883b52bb11bd77ec214834a5d862d1903
SHA256e6bd056563a766c535c73a977956dd7df3c14467b5238a916716203154c8dec0
SHA5123d621cc56593a473e58f935bf1c6a492b2fe5a5b005f28f5b51b8c61cd34259f55fdb1f80e4499db6d1c0cf04fbc7c88f6f8aefd97dac06ece3ddbcf0c395fe5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b