Analysis
-
max time kernel
136s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
05/05/2024, 07:11
Static task
static1
Behavioral task
behavioral1
Sample
168d8e16a3db6327170a35fab2d8d934_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
168d8e16a3db6327170a35fab2d8d934_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
168d8e16a3db6327170a35fab2d8d934_JaffaCakes118.html
-
Size
126KB
-
MD5
168d8e16a3db6327170a35fab2d8d934
-
SHA1
d695cffe04e2172c80847e37d8611e2a0102c2b0
-
SHA256
3923c230d23da2956f36f92f29d2f4beafc5049754210e876b9763c9727d07df
-
SHA512
1f2de255ebd9d01b3dcc06ae4f7b351643fb1c30b16feec244a04c0d6127c6256cca6cd9ab4579578b85f4ab32b320e36ab51ac0a01c5ce70ea08212e47914d7
-
SSDEEP
1536:K/7yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsn:K/7yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2508 svchost.exe 2768 DesktopLayer.exe -
Loads dropped DLL 2 IoCs
pid Process 3024 IEXPLORE.EXE 2508 svchost.exe -
resource yara_rule behavioral1/files/0x00060000000164ec-2.dat upx behavioral1/memory/2508-7-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2768-18-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px165E.tmp svchost.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000098b2170aa74a2ea629d7537d4738bb963f091dbfbcc9bdb4ea0dd80cf7691377000000000e80000000020000200000003421c9da243533d45436ae10ed85a5041e9f7f00e5ae4252e25dd7d0234a0c9f20000000d8331b2a73c0ba1636433d1236cc9599e8febfda772118c9870a990d17ffd4ce400000009ffeee4a5ec99674856c540db2bb19844d88d5f16002740b903f55a0ff125c1315cdfbae8488bac4fdb2427cf497884f72649b3530397ac8c3813fc0eac3f3b2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000eb7c2205b86595448397b981185d78294db17298fc7ddb39d1c7c30c704d64a8000000000e8000000002000020000000b83e560dc09ae0721022bb2b2052042619e9b2678e602bc05693e6f8950833c590000000e9e5c36315ce98bf90b39411d36a68bf68db5bb6d4764bc9bed5b445da10525fba993f8e39ed9598c22038ef8e9b1c192753c8711a7ecca0bea7323e88b690433480e63d0af11d0e6ff072bd09f9a59fefe290666cf0a41af4edf135a653bd68739997bf3b2959b6fc7517f01cca814a30d0c2d38b73337a9bb039b15d66bdf0b3dd4f86537e1bd17ea47454bd0b215f40000000decc581a9975df657f8658066b43ef458c9826289fa6af53ab3fac6b6d59d47f433741e276d30141f826f54988170635ea3a5a0ae7efde7f341e9ecaf6b214e8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C2EECD41-0AAE-11EF-9FEE-EA42E82B8F01} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d07f9dd6bb9eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421054986" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2768 DesktopLayer.exe 2768 DesktopLayer.exe 2768 DesktopLayer.exe 2768 DesktopLayer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2860 iexplore.exe 2860 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2860 iexplore.exe 2860 iexplore.exe 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 2860 iexplore.exe 2860 iexplore.exe 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2860 wrote to memory of 3024 2860 iexplore.exe 28 PID 2860 wrote to memory of 3024 2860 iexplore.exe 28 PID 2860 wrote to memory of 3024 2860 iexplore.exe 28 PID 2860 wrote to memory of 3024 2860 iexplore.exe 28 PID 3024 wrote to memory of 2508 3024 IEXPLORE.EXE 29 PID 3024 wrote to memory of 2508 3024 IEXPLORE.EXE 29 PID 3024 wrote to memory of 2508 3024 IEXPLORE.EXE 29 PID 3024 wrote to memory of 2508 3024 IEXPLORE.EXE 29 PID 2508 wrote to memory of 2768 2508 svchost.exe 30 PID 2508 wrote to memory of 2768 2508 svchost.exe 30 PID 2508 wrote to memory of 2768 2508 svchost.exe 30 PID 2508 wrote to memory of 2768 2508 svchost.exe 30 PID 2768 wrote to memory of 2704 2768 DesktopLayer.exe 31 PID 2768 wrote to memory of 2704 2768 DesktopLayer.exe 31 PID 2768 wrote to memory of 2704 2768 DesktopLayer.exe 31 PID 2768 wrote to memory of 2704 2768 DesktopLayer.exe 31 PID 2860 wrote to memory of 2392 2860 iexplore.exe 32 PID 2860 wrote to memory of 2392 2860 iexplore.exe 32 PID 2860 wrote to memory of 2392 2860 iexplore.exe 32 PID 2860 wrote to memory of 2392 2860 iexplore.exe 32
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\168d8e16a3db6327170a35fab2d8d934_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:22⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:2704
-
-
-
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:5911555 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2392
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8502d6a5d16adf68632160265b5a9e3
SHA1616e7b9e35033c67d9057c2693ba865dca31dae8
SHA25603437b6e8c2fe3242ebdaa561a3ddb33fa0df8c03121648ac24afa94c497a069
SHA512ff2d972c2531c6b857d58d345f062812843becbcd5651e1ff52b56dcfe6a7a80611c89f67d1d31c5a38addf0b972b796542148c543d6f801053260f32cf7379d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ccfaacc5288d8413e1085f090c89d9f0
SHA199aecb74e7e267099dcda6735f6fa9aa54b06d85
SHA25623a0fb123f0e95b30b9a134720f33b6a901c0984026f726d43520a2bf4e80ef0
SHA5128513932e3b7490dabac34f2795f20b51198ba0437bb61b61a7daaf6bab745bda5a062844bb123695ac1ea94802842be6aa0420000bb5274fd608d1e1f0e226a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55607e4fce5e4f82ba668bfeb9c6ab814
SHA15b349f41e9da9df74a80f669608ced061c266639
SHA25626bdf37ca950939b133cbe2c2a9b8f59099faa6637f1d277a4efc1940a8a8585
SHA5126bc6434dad30d1d030b457f3f9c0e83bdcf1cf4e9eda1c9ee70f9c5bdc2295eecbe63ded251b3223bc183621815f6cff2f1804b7ba0a3e800c4bb3836fbdf5d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541f5baca0f66fff6f40097830f67511d
SHA166e59a12472241c511316d764e748cd4c37bf852
SHA2563af2f537cccabb49d9d16f87fb7ba27a4c8e71e924d689f8c15a4ca780ba3249
SHA5125d8885d40caa80924aeb751415a2c563a58ed217685ac4bb780b8d397a6f4566c33329da5eacb2488ac589a65cecd7ba1252720208fe9043013f50c8ed49d914
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d96d684ee1f17757bd0a4e237ecbc28
SHA18a61d2aac1af8d46fc738b5032836593daa069ec
SHA256b9b463c000be966ac3662230bf0d3d59996aee163ae3f0ca5dbff1a4a7605e06
SHA5128307a79d44e6079427e6261be97eb9905dc63c5c216f866bd00710af4754d3d30a0cfc9c7b0f705802f0364418eb6fe6b455d8c25d902efcf68a00b21b4101ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a3eda336f3b8974f0010dc153001da1
SHA1db171af06e0381937eeacb4a2827b559a642b3fe
SHA25634b6ca3b64bd1290885b139ef5406015ef588c823f25100ecd5981a37cd1121b
SHA512c014b361f3f4115c987c2c4869c0cdcf7f392eb402ed0e2a02de8adf79fdbdaed049549037466916a1577ce4d9175a75824b41dc811b59f7c13f7fd073ed2076
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d4a6c4443b30973956adb6ccbf29bd7
SHA171ddaa07e6f6d7febb95c1f5b6ec45865ddcb551
SHA256fbeeb28ac9ef2a92b71c83e5f16d2231c90c46503e35dc1210b7afc19a59a13a
SHA512fbcd1b26a7febb330763978187730d71e1357af741a2423d1cecf28e6914d0e1cca031f69970d2727a2753e49a87867160ddb2164d493ee887e2e2046a3b77bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5673c5fd5d942427f3d8c426e30f9a98c
SHA1064ed00252ad534bcdc387f86d54c73314dd6007
SHA2560c6a24ec8715554f2d7928fecb0aecdfc7fbc789f4951691da92a9f0958a29ee
SHA512027187af1c44d18640be10bd32b57dd4f6932dba8fb3bcb64c053d0c7eb22a91920898928a39515cb9eb1612f561fdd1b030157d77af5c9f1b840d9e6c995b6d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a