Analysis
- max time kernel
133s - max time network
134s - platform
windows7_x64 - resource
win7-20240419-en - resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system - submitted
01/05/2024, 09:38
Static task
static1
Behavioral task
behavioral1
Sample
0b766f4ac0c38769a3ac0cca3a0f5cf6_JaffaCakes118.html
Resource
win7-20240419-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
0b766f4ac0c38769a3ac0cca3a0f5cf6_JaffaCakes118.html
Resource
win10v2004-20240419-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 0b766f4ac0c38769a3ac0cca3a0f5cf6_JaffaCakes118.html
- Size 159KB
- Sample240501-lme7vaea82
- SHA256 29d1468c7b8c973b69c82280486434097ed4be1f295b0bc920523e044529ad94
- MD5 0b766f4ac0c38769a3ac0cca3a0f5cf6
- SHA1 b3a65658cc634a722d9aeeefa592144dc11ef92f
- SHA512 3dcf8de99795628014e9c4b82559799df572509dd17085635baf1c2be564e599b8e6d068a98b3b95f92ddfee105d6a8f5cdfc3d96b6549051f17809e87ff364b
- SSDEEP 1536:iQRTaCZPf90GyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:i6HfyGyfkMY+BES09JXAnyrZalI+YQ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1332 svchost.exe 956 DesktopLayer.exe - Loads dropped DLL 2 IoCs
pid Process 2132 IEXPLORE.EXE 1332 svchost.exe -
resource yara_rule behavioral1/files/0x002f000000004ed7-430.dat upx behavioral1/memory/1332-435-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1332-436-0x0000000000230000-0x000000000023F000-memory.dmp upx behavioral1/memory/956-449-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/956-446-0x0000000000400000-0x000000000042E000-memory.dmp upx - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px1111.tmp svchost.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A113971-079E-11EF-9CF3-F62AD7DF13FC} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420718191" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 956 DesktopLayer.exe 956 DesktopLayer.exe 956 DesktopLayer.exe 956 DesktopLayer.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2036 iexplore.exe 2036 iexplore.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2036 iexplore.exe 2036 iexplore.exe 2132 IEXPLORE.EXE 2132 IEXPLORE.EXE 2132 IEXPLORE.EXE 2132 IEXPLORE.EXE 2036 iexplore.exe 2036 iexplore.exe 840 IEXPLORE.EXE 840 IEXPLORE.EXE 840 IEXPLORE.EXE 840 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2132 2036 iexplore.exe 28 PID 2036 wrote to memory of 2132 2036 iexplore.exe 28 PID 2036 wrote to memory of 2132 2036 iexplore.exe 28 PID 2036 wrote to memory of 2132 2036 iexplore.exe 28 PID 2132 wrote to memory of 1332 2132 IEXPLORE.EXE 34 PID 2132 wrote to memory of 1332 2132 IEXPLORE.EXE 34 PID 2132 wrote to memory of 1332 2132 IEXPLORE.EXE 34 PID 2132 wrote to memory of 1332 2132 IEXPLORE.EXE 34 PID 1332 wrote to memory of 956 1332 svchost.exe 35 PID 1332 wrote to memory of 956 1332 svchost.exe 35 PID 1332 wrote to memory of 956 1332 svchost.exe 35 PID 1332 wrote to memory of 956 1332 svchost.exe 35 PID 956 wrote to memory of 2984 956 DesktopLayer.exe 36 PID 956 wrote to memory of 2984 956 DesktopLayer.exe 36 PID 956 wrote to memory of 2984 956 DesktopLayer.exe 36 PID 956 wrote to memory of 2984 956 DesktopLayer.exe 36 PID 2036 wrote to memory of 840 2036 iexplore.exe 37 PID 2036 wrote to memory of 840 2036 iexplore.exe 37 PID 2036 wrote to memory of 840 2036 iexplore.exe 37 PID 2036 wrote to memory of 840 2036 iexplore.exe 37
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0b766f4ac0c38769a3ac0cca3a0f5cf6_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:22⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:2984
-
-
-
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:209935 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:840
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 33715b764b2f96a027e966176679bca32ea091ec5e7e6ebabaab38f5a32fc38b
- MD5 aa00a163bb902b5df5befc4db64d8563
- SHA1 c729150332984cccba0f410b136b3c5eca217cb2
- SHA512 d6b579bb82a816dcfd7c686d1047295c3f0329dbf165cc95fc9a2a789e275e34abf0e5cb0508169b585c8022461f0bb166a7797f7cb0f77e613ae439e5b48235
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 e41b8aa24cc43032d03b95d0eebb484cead457ad97643c415c313b7daabc32c5
- MD5 058294b57988d8b028520494bdf01f7a
- SHA1 c7f919d5522a30649702f104695575f55122f732
- SHA512 7993c6ea00d9ed5f5b9df280c1d5643473b719d8251d07a5178f65adca719ea3781934947ff3219472c4fbb1c092f6a8cdd4662fe10c528bf4bb01a2051d39cc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 e448fa0ab1d7c37770426a2aa3b9a365ae748d7ee6cd1e39555cd88d5d933ac9
- MD5 ff35b758bb6f1bb0254feecb674b3541
- SHA1 3e4f5ad551d444a970afa55b6fc9271e210c079d
- SHA512 635d423a88e5056ad68459331f46690dff9198563c3182cb44424665c1a4ade71a58cbe8fb0034d7d60d781f40a6cff559e098816986476b18b98ecea04961bd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 e203745a3f8e501789202db5ad43a1dc5c462096a433b0df34b473306d8cbc07
- MD5 0be34fb078df2beea034beaa1f7b44f8
- SHA1 db47fa89b5c9674cd831efb4926e85b9ae95280c
- SHA512 da60a1e7970a1301bad9a36d4b8c8bad5585f6f26812dd0a05c932fcba83b3757463842c63d58138f8a7db84271238356577d507e834462a2835ec749c5af291
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 ea5a97e4b3a559f333d07c668a4116a09b12a730d7f86c16f165b3efab7aa989
- MD5 77907ecf358e5defee77431f4d95a47f
- SHA1 1b2c85b0da00821bfe2985a3e5775494e293f1a3
- SHA512 006281efa66332d2e45c1db9118e66ea07bb82533cfdb950f6e0d126e951c30cfa625b18735bcf3f859df8dab267847459ecec73ba38c40272b5c7aa026e31a9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 92fb4837f7606d0095747cff7330003f0095c99de21420de5b7a359b4da60f4a
- MD5 241e0059dbbaabfb672d7edac4a5e314
- SHA1 2e600171f99a8eec4d7348f410754a78b161a485
- SHA512 3de27d05285981caeb54e1589d4cebb36c76da152d1774103560394c9b6396b16db2e6683aa113073cec5a130b64aaf8bbb71c8621b7b9a3d0e13c06d868f660
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 907b0ab3b7a27d148103a7aab827c09dda84cb3d77635d50a409d4b105bcd31d
- MD5 b2b35e7979a4b067829fd09ad95ea1b4
- SHA1 7698d443609c5ee5a7e34e780b8b831962a5929c
- SHA512 1a06b3c0bd20c68de5ae091861354b5ab6fcbb423eabe544f84cda1a8a35908976c0289c6acad92be9f5f6333f55f143d724538ca7d7a072f26985c42b9adc40
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 397aad80db0657df5154ca4631d73eb0b48e362cf462e1d136a4736ace360466
- MD5 edb11adad2d69dcbac5edfd6ef9eaa8c
- SHA1 813d59d4e56a3e411734ad61581821ea6353cbc0
- SHA512 77c079279479a7bad89315e75db641b8e2c26bf620ddcc7638252fa23e3f70d1b74806140d808cb6a2d8d78a4b6277b952a786545f54feda89b587f009f6290f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 414e17a06fc2bd185170b73d098792fd8dca81cf4817ba97dc6d32d3ef8ba440
- MD5 32511b1ae6f431010c5001f402b8d6d5
- SHA1 f388be7dce2ce1c853a2cb16e3df410da780f1e2
- SHA512 acf5441c1e8c5993340831ef894e076159132b66135ec97adabbb36a4491bab13a5e293851c23b325bc62aa9b88f3d3d9ef0f1d0690dfb726d554cab18650e99
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 488a8f66cf9da51faaf4c5fffd0b0c7b6e648be9cb209303a808b5021ebeeff7
- MD5 b37f64485ad9aa55141847b8fe432d19
- SHA1 c05826eb304e2246cb4045bcaf05192f7fe53a13
- SHA512 9358f7956938524669d3c48e3b89065c280fcd6e41b4b5e0cf39eebf8e5aff765273898c99dd85738319a69c76ac3f2b79bee785c5f5a663c73bf8648fd927d9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 9f0818c875cabea8c64d46d95e961597ab4fea9b27578e888ad99564386e0fd6
- MD5 3b4df80dba9b8ab478cd03c99ab90af2
- SHA1 6fda9574da46e16dfc28ef2de9874723e0b59c28
- SHA512 e0e346a2474488ac7ec99ae489281c03f601cc34a1b216d6ed24f1e1fdf1c351c292c2eadc99a8fcc9a883e6904260cfd9bb93b721056dc08f117b0befe77448
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\Cab2B76.tmp
- Size 68KB
- SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
- MD5 29f65ba8e88c063813cc50a4ea544e93
- SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
- SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
- SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar2BC7.tmp
- Size 177KB
- SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
- MD5 435a9ac180383f9fa094131b173a2f7b
- SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
- SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
- SSDEEP 1536:fAo/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mJ:f/J+qTR0XCy/dmASru2Aijbdq
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\svchost.exe
- Size 55KB
- SHA256 fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
- MD5 ff5e1f27193ce51eec318714ef038bef
- SHA1 b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
- SHA512 c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
- SSDEEP 1536:Q+hzRsibKplyXTq8OGRnsPFG+RODTb7MXL5uXZnzE:bROzoTq0+RO7IwnY
- MD5 SHA1 SHA512 SSDEEP