Analysis
-
max time kernel
119s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
11-06-2024 03:30
Static task
static1
Behavioral task
behavioral1
Sample
9cdbb1d19bae44c4923d7eb6e404db9e_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
9cdbb1d19bae44c4923d7eb6e404db9e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
9cdbb1d19bae44c4923d7eb6e404db9e_JaffaCakes118.html
-
Size
148KB
-
MD5
9cdbb1d19bae44c4923d7eb6e404db9e
-
SHA1
7c00281beb27e2cd703a4654be05d7d3d859e53a
-
SHA256
0d6db6306bc2c0addfcfeb81765479daa6e948b55fbad2a5a17d35fb29c76a83
-
SHA512
7fe4e3bc8f324581de4a5cdb810e316c60f1f6ad8d9e523ef27d0394c9326de96fe10f0942003bf38fba949c4c3f29fe877400310e1b298220136acb086a048a
-
SSDEEP
3072:EnEkvHcZXkniPmyfkMY+BES09JXAnyrZalI+YQKn:HjsMYod+X3oI+YQKn
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
svchost.exeDesktopLayer.exepid process 2436 svchost.exe 2508 DesktopLayer.exe -
Loads dropped DLL 2 IoCs
Processes:
IEXPLORE.EXEsvchost.exepid process 2148 IEXPLORE.EXE 2436 svchost.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\svchost.exe upx behavioral1/memory/2436-7-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2508-14-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2508-19-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2508-18-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px8298.tmp svchost.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe -
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6047bee3afbbda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000035e99a300c8e39439343982446ad8d8d00000000020000000000106600000001000020000000fab29fddaac58296b6a8d8730f502c445df008cf4eea1552025f324d01b903b9000000000e8000000002000020000000cd39490a2fb3f7b07b61fa0049677ac2c5bfdacbbaa3920d40490eab495a342c900000005664fe63abdaf05b7d207875483ff14cecad6b212389eea7b6ec079d216e55306c2e3d1fee332111ace5b1a74706b266c91d4b343ef45eeab60da45d6edae8a2c605b6f22d32919a6bbe01078b278f28ebc53200d87b5820d70335491bbd8db664d669263251f8af89da9ea884df59fd00cc1681bf1c46affe19f4cb0fafe84550ddb5d54f13b88beb01b46a5a3851af40000000a6c2f09cc00d55d564ab8b1040bec296b0574dfa8f0dfa5f1dfa6f4f9059ae5df464be9925b6835f12fe9e557e5b6993976d49f0970cea90f21b2fa1077f63df iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424238500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F5330711-27A2-11EF-852B-6265250A2D3F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000035e99a300c8e39439343982446ad8d8d0000000002000000000010660000000100002000000043a5262d3c1495a1b33da97385df9e00861f0797cbc81c9d330808365f82c995000000000e8000000002000020000000920a7f7b8e9560e013658d6d7a49d526683070b493febaf8fdc218d46fd549fc20000000fce2edba5ac03f2c35423ccad72e4adb7e1c68eccecac0ba8ab0d033c018409240000000cc234cba90844f7325db5f923998c433fa8098e514628e3014e8e2df8b0c8b1e644194049855097f1a9a016c8eb30b3bbb6b05729b9223b6e58526c0521735ed iexplore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
DesktopLayer.exepid process 2508 DesktopLayer.exe 2508 DesktopLayer.exe 2508 DesktopLayer.exe 2508 DesktopLayer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exepid process 2764 iexplore.exe 2764 iexplore.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 2764 iexplore.exe 2764 iexplore.exe 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE 2148 IEXPLORE.EXE 2764 iexplore.exe 2764 iexplore.exe 1668 IEXPLORE.EXE 1668 IEXPLORE.EXE 1668 IEXPLORE.EXE 1668 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
iexplore.exeIEXPLORE.EXEsvchost.exeDesktopLayer.exedescription pid process target process PID 2764 wrote to memory of 2148 2764 iexplore.exe IEXPLORE.EXE PID 2764 wrote to memory of 2148 2764 iexplore.exe IEXPLORE.EXE PID 2764 wrote to memory of 2148 2764 iexplore.exe IEXPLORE.EXE PID 2764 wrote to memory of 2148 2764 iexplore.exe IEXPLORE.EXE PID 2148 wrote to memory of 2436 2148 IEXPLORE.EXE svchost.exe PID 2148 wrote to memory of 2436 2148 IEXPLORE.EXE svchost.exe PID 2148 wrote to memory of 2436 2148 IEXPLORE.EXE svchost.exe PID 2148 wrote to memory of 2436 2148 IEXPLORE.EXE svchost.exe PID 2436 wrote to memory of 2508 2436 svchost.exe DesktopLayer.exe PID 2436 wrote to memory of 2508 2436 svchost.exe DesktopLayer.exe PID 2436 wrote to memory of 2508 2436 svchost.exe DesktopLayer.exe PID 2436 wrote to memory of 2508 2436 svchost.exe DesktopLayer.exe PID 2508 wrote to memory of 2140 2508 DesktopLayer.exe iexplore.exe PID 2508 wrote to memory of 2140 2508 DesktopLayer.exe iexplore.exe PID 2508 wrote to memory of 2140 2508 DesktopLayer.exe iexplore.exe PID 2508 wrote to memory of 2140 2508 DesktopLayer.exe iexplore.exe PID 2764 wrote to memory of 1668 2764 iexplore.exe IEXPLORE.EXE PID 2764 wrote to memory of 1668 2764 iexplore.exe IEXPLORE.EXE PID 2764 wrote to memory of 1668 2764 iexplore.exe IEXPLORE.EXE PID 2764 wrote to memory of 1668 2764 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9cdbb1d19bae44c4923d7eb6e404db9e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:22⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:2140
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:537611 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1668
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53564f1a2cf168db59a307832ce3e6692
SHA14716eeddd88ea59aeca16316b3b230b577b19b73
SHA2564868bcf0e76d526d933002ef2115b9082a8b8d4d5aa829d4673ff6428b7d5180
SHA512c740ed56562f57a800a21217b316a9d7b27122a9b423e61cfe3c7cd345f6ee8088364b44014f5ff3c87eba7493a6f9f5cf503ea0c8531569a6a6ea112951a0b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c0bf43ce3b49f095eda3c59bc6cd110
SHA1bbc3dec74ab267afe8f2d28f3d17124f33c7932f
SHA2563326e5ffac86dc137423cb40758c69112a65f6c4315e4dcf2c61da310262e8d6
SHA512a8bf76981720bd04aee4b1f890ad6e588a3e17e40fc7c803e37503fcc0e6b36883d6289bb149aef6bb9088e60e1d73dfca50c61129b9637411c42976bdc12c28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b89a65c30e790b8b1a85f0eec285388
SHA13e39a1a7c7cf300f9db0a0d1a63329f76de460b7
SHA25656878364b48fda49dc67139d3bb5899e2530e209c7b0ce9cedb5b4749238a76c
SHA512e615a2a63982d366ada057dbd7a54691f58410f7dff3768490d563ce3e09ae312f84b01da90ecb8f6801c025453866a0390b205ca3bf7a0e2d7c9d4edbdca804
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD555acc16e1a7d0b0b8f8cbe7383b82296
SHA1ea839a7924b7479ac005984c1bbb7098f16068ab
SHA256256e699ba0d10c90a3e84702439a89b339c09d1dc5f19916f12cc3f9fec3487a
SHA512f44d1f1d19d0716e545f466ce6d4912440753bbafb2983f13f88b848c83e34cdc45e98e731deb9adc9665ac37648277712d2d1ffcca414a082efb04bbb938abc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e5801861bf0435b3f7f7011353b9ebeb
SHA152d3a62f2538bef5dcc2938078124550f3d27235
SHA2564eb297862487f13cb76495c663bf47531883d5abbf301b143206915983786cbe
SHA51229c8512c6417f5fbaf2f696c3dafe71a8ed5eacfa0a557c348ddd48630c2eb119713924fa0a70fbc969e8153cf715f71fcd4d986a3f031d05f81415ae955f4a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e6f56e0849b18eb97ec0706f7c657625
SHA192b19af3c1cc1654eb505638e696bb9d6b7bd50c
SHA256687c24beceff5900a8b2cd56d8f89819633fb5334df1ab9ec41bd70a692a39b9
SHA5121f896bb27b31f0b918afab65aeb8709f43c2059e8a1f6974870bb2d508a8d1ebcf81543817cadca360f81270a9bb8518da133e081ff4336e84295e93a30bfb1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6e3c05081b73e988a852222a80fdf9b
SHA10541a4003ec22e9558ad3aaef16f3799d8eaa4a6
SHA256b57fdf8f8a53481d485712b862653454181ff7121c1534d50bccb9dca5ea5ed3
SHA5120c009c8c554d25c62b0038adc0e292ecf48c6c4d8ed6c00226859435968ec6e1b321eae8122531b1a65ee40b068e7ca76b003ac643b9daadbf33ad69fa39c63c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e94249a7d64911063465ca538c90fcf4
SHA199c37f048e784b6bbc53ab7ec36e484520d534d8
SHA2561a425b261f8b63488758228f8ccdce8feab916563b928a7a1b8abb9f90861849
SHA5122cd6b225dd94e073b703d536d148d715d72669e9d101ff2f7e5ec3334aa2cbd54c1e158de76a08c64aa5c0bdb8509da2eef9a3c05ad46235c84703445141042e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd086e1b343b8d20226da14ab73928c2
SHA1a8640d3bdb2b7fb53a6b2ebf35831f2b19284743
SHA256a2e14cbad413a7de6f57e4e3e120fa7d31578c9874a377f0c66030bd5487fdb2
SHA512433643a45fc8f5e3370753220acf3c0bbc05df1eab1ed790303a5122c7cbef8dc9e2c535e501ae5b61b5fa24d2dc689c9eedaed17137e69c267bf35afcf59c0a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a