Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 10:02
Static task
static1
Behavioral task
behavioral1
Sample
04f0c473d9f8a89ee5b78689a6676b4a_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
04f0c473d9f8a89ee5b78689a6676b4a_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
04f0c473d9f8a89ee5b78689a6676b4a_JaffaCakes118.html
-
Size
350KB
-
MD5
04f0c473d9f8a89ee5b78689a6676b4a
-
SHA1
a77484e14c1902476ceece217c7334c52cb36fac
-
SHA256
7d28f675100247bee7e4f49b6f001c18272fc8a8ec969ee03057790a4015b0f2
-
SHA512
b73ef00060e86e54f45ec29c0660ac0ee9cdc31a9d4514cf2556f01cd1e427913e5548371a639d9c9a6905696202bac3111670094a5b5af575424fac456387ac
-
SSDEEP
6144:5sMYod+X3oI+Y69sMYod+X3oI+Y5sMYod+X3oI+YQ:F5d+X3Q5d+X3f5d+X3+
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
svchost.exeDesktopLayer.exesvchost.exesvchost.exepid process 2672 svchost.exe 1836 DesktopLayer.exe 2556 svchost.exe 2248 svchost.exe -
Loads dropped DLL 4 IoCs
Processes:
IEXPLORE.EXEsvchost.exepid process 2144 IEXPLORE.EXE 2672 svchost.exe 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\svchost.exe upx behavioral1/memory/2672-6-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2672-9-0x0000000000230000-0x000000000023F000-memory.dmp upx behavioral1/memory/2672-10-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1836-21-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1836-20-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2556-27-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2248-30-0x0000000000230000-0x000000000023F000-memory.dmp upx -
Drops file in Program Files directory 7 IoCs
Processes:
svchost.exesvchost.exesvchost.exedescription ioc process File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px9A2.tmp svchost.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\pxA6C.tmp svchost.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\pxA8C.tmp svchost.exe -
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00b0b4595399da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420460438" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B9C55C1-0546-11EF-9A0E-5A3343F4B92A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000d0fce4f701ac4bdd5333159c4c5ef5e2d32f133224f489a5bb38d95b220b6e50000000000e8000000002000020000000a8022e992ae9ce5e31792d0acbafc99d38a93969fae323fe1f10680c088cc1792000000064f012e85af30a44ecadc290161177237c4bb0222b4c6de89136a8a2d6a208754000000066b9c11b45b0c62ffbfbfbf1782660c780ac26d7f60b36dde02419cef55ebef0f71a86137f9dab09be495c3aa5d3d920171a46a90d27469d0749b4cd6b5d4aa5 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000a070ab2e401d82409babed03ffb5e59c7d01b4cd005f726c2b6335e51ea0f81c000000000e80000000020000200000007419ace839427c06678d6c3d32127375d0ba86df397c6928de54226a08cf8efc900000001864b5ca283fc8cac974bca0fe201d504b7de004c649c7105b0576bcaa933c775a007c6073767f9279c54f382a0518b5e32d68f53632d5888f2c573bc671c254a303e747c3ec64a54e863b0a7d08ee3b075738d544e7679ecd8138451c3ef66618e4c4d1f419a8906ffb6db6aad3c7bf4e747e4c9daba896887dbe4657f6c0d3b883cbcfd6004e395c49b6226e41d60040000000f53bd244867be19222a06de327313737d2dac00ccd69bf55fff04166c1047b097928428ff7551be09d6e505f5f208e235a493943e20dbc8703a2857db6a09f79 iexplore.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
DesktopLayer.exesvchost.exesvchost.exepid process 1836 DesktopLayer.exe 1836 DesktopLayer.exe 1836 DesktopLayer.exe 1836 DesktopLayer.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe 2248 svchost.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
iexplore.exepid process 3000 iexplore.exe 3000 iexplore.exe 3000 iexplore.exe 3000 iexplore.exe -
Suspicious use of SetWindowsHookEx 18 IoCs
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEpid process 3000 iexplore.exe 3000 iexplore.exe 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE 3000 iexplore.exe 3000 iexplore.exe 2568 IEXPLORE.EXE 2568 IEXPLORE.EXE 3000 iexplore.exe 3000 iexplore.exe 3000 iexplore.exe 3000 iexplore.exe 2872 IEXPLORE.EXE 2872 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
iexplore.exeIEXPLORE.EXEsvchost.exeDesktopLayer.exesvchost.exesvchost.exedescription pid process target process PID 3000 wrote to memory of 2144 3000 iexplore.exe IEXPLORE.EXE PID 3000 wrote to memory of 2144 3000 iexplore.exe IEXPLORE.EXE PID 3000 wrote to memory of 2144 3000 iexplore.exe IEXPLORE.EXE PID 3000 wrote to memory of 2144 3000 iexplore.exe IEXPLORE.EXE PID 2144 wrote to memory of 2672 2144 IEXPLORE.EXE svchost.exe PID 2144 wrote to memory of 2672 2144 IEXPLORE.EXE svchost.exe PID 2144 wrote to memory of 2672 2144 IEXPLORE.EXE svchost.exe PID 2144 wrote to memory of 2672 2144 IEXPLORE.EXE svchost.exe PID 2672 wrote to memory of 1836 2672 svchost.exe DesktopLayer.exe PID 2672 wrote to memory of 1836 2672 svchost.exe DesktopLayer.exe PID 2672 wrote to memory of 1836 2672 svchost.exe DesktopLayer.exe PID 2672 wrote to memory of 1836 2672 svchost.exe DesktopLayer.exe PID 1836 wrote to memory of 2776 1836 DesktopLayer.exe iexplore.exe PID 1836 wrote to memory of 2776 1836 DesktopLayer.exe iexplore.exe PID 1836 wrote to memory of 2776 1836 DesktopLayer.exe iexplore.exe PID 1836 wrote to memory of 2776 1836 DesktopLayer.exe iexplore.exe PID 3000 wrote to memory of 2568 3000 iexplore.exe IEXPLORE.EXE PID 3000 wrote to memory of 2568 3000 iexplore.exe IEXPLORE.EXE PID 3000 wrote to memory of 2568 3000 iexplore.exe IEXPLORE.EXE PID 3000 wrote to memory of 2568 3000 iexplore.exe IEXPLORE.EXE PID 2144 wrote to memory of 2556 2144 IEXPLORE.EXE svchost.exe PID 2144 wrote to memory of 2556 2144 IEXPLORE.EXE svchost.exe PID 2144 wrote to memory of 2556 2144 IEXPLORE.EXE svchost.exe PID 2144 wrote to memory of 2556 2144 IEXPLORE.EXE svchost.exe PID 2556 wrote to memory of 2648 2556 svchost.exe iexplore.exe PID 2556 wrote to memory of 2648 2556 svchost.exe iexplore.exe PID 2556 wrote to memory of 2648 2556 svchost.exe iexplore.exe PID 2556 wrote to memory of 2648 2556 svchost.exe iexplore.exe PID 2144 wrote to memory of 2248 2144 IEXPLORE.EXE svchost.exe PID 2144 wrote to memory of 2248 2144 IEXPLORE.EXE svchost.exe PID 2144 wrote to memory of 2248 2144 IEXPLORE.EXE svchost.exe PID 2144 wrote to memory of 2248 2144 IEXPLORE.EXE svchost.exe PID 3000 wrote to memory of 2872 3000 iexplore.exe IEXPLORE.EXE PID 3000 wrote to memory of 2872 3000 iexplore.exe IEXPLORE.EXE PID 3000 wrote to memory of 2872 3000 iexplore.exe IEXPLORE.EXE PID 3000 wrote to memory of 2872 3000 iexplore.exe IEXPLORE.EXE PID 2248 wrote to memory of 2760 2248 svchost.exe iexplore.exe PID 2248 wrote to memory of 2760 2248 svchost.exe iexplore.exe PID 2248 wrote to memory of 2760 2248 svchost.exe iexplore.exe PID 2248 wrote to memory of 2760 2248 svchost.exe iexplore.exe PID 3000 wrote to memory of 2936 3000 iexplore.exe IEXPLORE.EXE PID 3000 wrote to memory of 2936 3000 iexplore.exe IEXPLORE.EXE PID 3000 wrote to memory of 2936 3000 iexplore.exe IEXPLORE.EXE PID 3000 wrote to memory of 2936 3000 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04f0c473d9f8a89ee5b78689a6676b4a_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:22⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:537606 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:2569221 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:6829058 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
55KB
MD542bacbdf56184c2fa5fe6770857e2c2d
SHA1521a63ee9ce2f615eda692c382b16fc1b1d57cac
SHA256d1a57e19ddb9892e423248cc8ff0c4b1211d22e1ccad6111fcac218290f246f0
SHA5120ab916dd15278e51bccfd2ccedd80d942b0bddb9544cec3f73120780d4f7234ff7456530e1465caf3846616821d1b385b6ae58a5dff9ffe4d622902c24fd4b71
-
memory/1836-18-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1836-21-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1836-20-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2248-30-0x0000000000230000-0x000000000023F000-memory.dmpFilesize
60KB
-
memory/2556-24-0x0000000000230000-0x000000000023F000-memory.dmpFilesize
60KB
-
memory/2556-27-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2672-6-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2672-9-0x0000000000230000-0x000000000023F000-memory.dmpFilesize
60KB
-
memory/2672-10-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2672-13-0x0000000000240000-0x000000000026E000-memory.dmpFilesize
184KB