Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16-02-2025 05:52

General

  • Target

    JaffaCakes118_fffd99e8fbb30cc91081b6ec0a6b98c7.html

  • Size

    99KB

  • MD5

    fffd99e8fbb30cc91081b6ec0a6b98c7

  • SHA1

    908801e3ab0813010b3d7f427a2d9d2ec21d38a8

  • SHA256

    440837ebce0aefbb0817c0bc6b1896170e76be42d20759afaeb5d764d2be6315

  • SHA512

    0a21e16ea954bf8e193d4d4e7dd2058947ab575e949ba2c3c3d92eaa0491d7277a64e28bcb7633f88e49b28cf07ce3ed8362a3a818c50585c2234ab35f89cf3b

  • SSDEEP

    3072:0gpodXhXUodXhthvj8GnpI7MMj2M8cmC24gDtsr:Kj8QpI7MMj2M8cmC24Dr

Malware Config

Signatures

  • SocGholish

    SocGholish is a JavaScript payload that downloads other malware.

  • Socgholish family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_fffd99e8fbb30cc91081b6ec0a6b98c7.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1148
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1148 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2248

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

    Filesize

    1KB

    MD5

    55540a230bdab55187a841cfe1aa1545

    SHA1

    363e4734f757bdeb89868efe94907774a327695e

    SHA256

    d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

    SHA512

    c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

    Filesize

    230B

    MD5

    6333e0bd758a87bc2d0b758b442ff869

    SHA1

    8ce041cfff41a211a54c6fdbc71ae866da3f3fae

    SHA256

    1dfce1225c797183847bff046646ef93da9eaa18d978ffc2706ad2c4dca5df0d

    SHA512

    669c01040f6e1b31e2a7d4975becfc47704452fecb628857e9a2ac53e23e36588da0c6e262b39aa68b1333689356c6e2ca92455d3dc7ce7575625ae8745fbb81

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e3e2d7a64e3fe5e762171104c3df8376

    SHA1

    ff38d1157d469cdca190bcf614090ac7c3314162

    SHA256

    98447392401559a412739a537780dfb268fc2bb50037acc0c480f69868998200

    SHA512

    e904c5bc976ed8ffb4af297fcfd1a9c0e1a76cabd419948a77d8e8f51a483a0392ee7efdb780acf31ca7e76f371cfabf75da081991543ec6b2e8ebdeac706e48

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    54678e9945b572e7234c0bd6f8152613

    SHA1

    16fc68eef1dc9e2c169e859321b4a19cb16b886f

    SHA256

    f50e2bc02caef9668e7f3a773048400f1f8e2d1cababc8fbf0bc6628505c35ef

    SHA512

    768265de89a174109b4a32238114d869df12dcbb9375f353257625b4df38724b65b82c61a6985e01942bd0c78dc719bfd61aedf690661015b1ad3e936980da60

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    57f8bfef911c108e836d914f9e27a6f3

    SHA1

    41ae3b08ebd8f757ef1237c1eaa89e315247654f

    SHA256

    12726e9210ac9a68bf5d86cdee109d075b5df9c6ad25754d413bc34e2f4b8029

    SHA512

    3aa69ed6fffd3da0da41f68e0b405d16eb0bcd0b55b7c614be4b2f66fc83ad74c1c7c10a7c62f093f38b3d97dbdb8016cf065193061d7696da10eb1d92536b13

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    47787424eb75a58fc2c935172d2e3936

    SHA1

    e5601540f8a4c134c0685c7c7d1f201a077efa04

    SHA256

    76835700ec523c3639fee70ba602e193df7b0783f91685795352121c5b9555ac

    SHA512

    05e6949dc8698f44a844a9c153f4d8a5083f4f2d9feec7dc4eb082fb727ac05b9568afb18a9e51bf499a95b13e2ca826d99c1016d118b576e6d323a01e2ca502

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5cceede2741e5084b628eac67c80d605

    SHA1

    3094d63315b46845b6e417b8b5da2ed4734a83bd

    SHA256

    8956438280311c47f8445e67c4fe1ecabc4b4cdbaf4bb4012a04ce447577036e

    SHA512

    25ffebdddaec630836dbe17b88a7169fc096ff60bd8dfe795d92fff7d00d607cb3a13e11b246748fe6881ff9b97b72616681db496e75384a39c1753aad288fc8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    21598327ed63f5b65a4ed83f976bf535

    SHA1

    547ada53d09c0470cdbee14a45268eefdbae0037

    SHA256

    e3b8f569becd91f81831d38366b44ec1d2e3524e1f393aecaa359056b9b1d55d

    SHA512

    7e5c9d48c85155a72e9fdb3b0ab6d946d6e3af71a45102a508830307000762ae07a828103836d39f9c6703eba7124cddef994609c048fadd3ead4d242d485885

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7717494b6452bd290e2e9fa9cf907766

    SHA1

    c1bc1b699e0ef852e675ea549bbda454ffe9f355

    SHA256

    e014afb82b4c8e1233bd7b028fbc489b063f4bb6591b578bc0bd599156f258f0

    SHA512

    c0bb689e94a8243dec34817cea3202ea293ad9776f854cacfa0d83a517aee8a7d2cba1ca17b8dc0ef38d70f2e4188e86345f6e1da22def51549930ef14063a10

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6a446ed259ddac77e2b062c3473b58b0

    SHA1

    a02942a59df66d7e1c0973d3196ea48991b3dae2

    SHA256

    a6e8d00cc4d108d925315109f20125d8430e958bcd95acc7d145dd5c970fffbc

    SHA512

    6765a65740f5f5aedca407d713e222c4ff54ee0ce868b6d444fcd3c04352fca3757d4625defed4f68aea97b0ef0a4d8e9b726fbbb3fb625ca723d4c89b635c01

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    dd2db46c4d30a40f3762fc0015d7e23e

    SHA1

    a027cc42fd7a426f577f7468723cc5e551a65b66

    SHA256

    4810a78aebd6ed386e6de6cee0505433c7ced355e69b1d6547430d483107a238

    SHA512

    6e8d4027bc44bcacf803f11430ccc276d931a2a9bf8b90782eb5e9c636a47f807e3c237929c7aed71c722700210128df8b7da754b161f2eab664e482a396b388

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    55f9b75fb9f5068dd6c7b4115a869c37

    SHA1

    06f490552d82d7832439fc0082468a613377e4dc

    SHA256

    8a8c61eb88ddf680989ed2dd17440a715a6bf8e98493db0f5881cab057712eb0

    SHA512

    918f554d01df2d10fa3d4c1e0f7f8e4c251d377b16b52102aa27018bd0cbabbfb8d56e8bf4ca47b9232b1ccaef0dd5475b539750907f5c142c474261f2e9ac62

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    309905b0c93bf9124b6cd166f32bde70

    SHA1

    b98d6da776738c1e01695aafde87745f91b23f1d

    SHA256

    abf530149791962e8dddeef9ea92ace7ea00f95f288ccb19476dac61332cb155

    SHA512

    43466b2082bcefe0e91e9582f7002bebb82025ce85263395a08535ec80ed297cb46a6c6fab8eab7a006776421ae9abe8528ec7e7760244863afd7559987971b3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fbb1392f7b6bd522b35f48991854f61a

    SHA1

    2bc148cc2cac2bb99034a366ba83e864abaf5c55

    SHA256

    8fd9f6da9091813d5d976cb1bd5d0ddca0be5ace2f41e53f9056ef42c5430210

    SHA512

    05349c2c968cc9a7c85d35508987fbdc537db9aa5529991b7d7de2e3142d9359d390fabdc7b1cfca0e57953a8727fa2ad387aa1e943bdafcdcc7730cad340712

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0aacbc0bf5f96aafff80b53a579cb187

    SHA1

    c769a2a7c4e5b55cebab8ef9c18f4dfcea32deab

    SHA256

    08f93b924c8e36d3ec20deb3fc9cda41b6f8eca9fa2957c8fd53a46edb1945c5

    SHA512

    75f5df63716b7f05d73ca48e271d764d1d4d7b2fd69e6f790b94e2cf4886b94380cad2c874229126dcca6bb9fd7e36d49eff18f8f39e2f7a99477f7547f14fef

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    98abc3ea16e92363d4e8f61b616a2bcd

    SHA1

    64c3b99883b52bb11bd77ec214834a5d862d1903

    SHA256

    e6bd056563a766c535c73a977956dd7df3c14467b5238a916716203154c8dec0

    SHA512

    3d621cc56593a473e58f935bf1c6a492b2fe5a5b005f28f5b51b8c61cd34259f55fdb1f80e4499db6d1c0cf04fbc7c88f6f8aefd97dac06ece3ddbcf0c395fe5

  • C:\Users\Admin\AppData\Local\Temp\CabDAA8.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarDB66.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b