Analysis
-
max time kernel
141s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 06:02
Static task
static1
Behavioral task
behavioral1
Sample
b208c7d4544bf1518aa275d3b9b9650e_JaffaCakes118.html
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b208c7d4544bf1518aa275d3b9b9650e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
b208c7d4544bf1518aa275d3b9b9650e_JaffaCakes118.html
-
Size
116KB
-
MD5
b208c7d4544bf1518aa275d3b9b9650e
-
SHA1
4145e3c0d224a02f8c8061fe31808db41de01fbb
-
SHA256
88fc9e3994f40b6d8e151b4d265310342477445f784286a4e24769471db0e61d
-
SHA512
9e9526e13a77b7d96f88b680ae6e3a152f39cae0eb3826cd01603852d254e04a72e07044dbe1dd5d117ada85608075f9eba800161f963abf87bdb5419a112f38
-
SSDEEP
1536:SCESioyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dK:SmyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
svchost.exeDesktopLayer.exepid process 2616 svchost.exe 2620 DesktopLayer.exe -
Loads dropped DLL 2 IoCs
Processes:
IEXPLORE.EXEsvchost.exepid process 1676 IEXPLORE.EXE 2616 svchost.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\svchost.exe upx behavioral1/memory/2620-18-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2616-8-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
Processes:
svchost.exedescription ioc process File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\pxEEF.tmp svchost.exe -
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a03905000000000200000000001066000000010000200000002bfb13fc82f7227b32c7ab6da1a8f7033737ace5bbab747a9c2506ec7e25555f000000000e800000000200002000000088b03b2d8f97bca169c185c36739684d80ef20a6fc0cf5cb9979a21e4170083c2000000077cfd7c370489cf29ab237102ff7ad7a03b0d603cfdee00eee58c155d9d1109d40000000515d757a9732f7d696c18c90bd82d68d824624b17773b71517d483491e01927bc3724e957317fa7e50e06f8c0d4f1105bfbb4185b5d874308d5f1793c686f3a4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006fb3d087c4ee9c4bb22550fd83a039050000000002000000000010660000000100002000000019a94997f6a555b1c64487d219d80a8adef14a207bae3035f3a17f100cef9163000000000e80000000020000200000002573e8d28ea052db2ffacecbd7ca0f0d603b8d1d0fd7253268130a49e55b8c5c900000003529d8118a025898c219d1da2c4bbf30d1135b1aae0651df7f314967e06c14a73d654d5f4533a68ea7209e5060c3c2f13e2f3ead1c751e0ba9031b5fe2dcdce15d1f5eeddfc47fa9ce297d36414fdffdd70f4be83260461df22672c34bbcc686112e0ed3718bbc2bc8ea7f176f8f56aea85ed797f72e09c10f474830300b45877e1da4b52c978da6eca9425fa3b94c9b400000003b11a7af6008baee9ead1ebb817c892f7dccabfd42dfc77741097ef0442c5a55b6055096261c02632af343cbcc2e6e3b5ee8cdadcdc1046a133835f9bf23b42b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0065BE01-2BA6-11EF-A43E-62EADBC3072C} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 508c8dd8b2bfda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424679612" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
DesktopLayer.exepid process 2620 DesktopLayer.exe 2620 DesktopLayer.exe 2620 DesktopLayer.exe 2620 DesktopLayer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exepid process 1460 iexplore.exe 1460 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 1460 iexplore.exe 1460 iexplore.exe 1676 IEXPLORE.EXE 1676 IEXPLORE.EXE 1460 iexplore.exe 1460 iexplore.exe 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
iexplore.exeIEXPLORE.EXEsvchost.exeDesktopLayer.exedescription pid process target process PID 1460 wrote to memory of 1676 1460 iexplore.exe IEXPLORE.EXE PID 1460 wrote to memory of 1676 1460 iexplore.exe IEXPLORE.EXE PID 1460 wrote to memory of 1676 1460 iexplore.exe IEXPLORE.EXE PID 1460 wrote to memory of 1676 1460 iexplore.exe IEXPLORE.EXE PID 1676 wrote to memory of 2616 1676 IEXPLORE.EXE svchost.exe PID 1676 wrote to memory of 2616 1676 IEXPLORE.EXE svchost.exe PID 1676 wrote to memory of 2616 1676 IEXPLORE.EXE svchost.exe PID 1676 wrote to memory of 2616 1676 IEXPLORE.EXE svchost.exe PID 2616 wrote to memory of 2620 2616 svchost.exe DesktopLayer.exe PID 2616 wrote to memory of 2620 2616 svchost.exe DesktopLayer.exe PID 2616 wrote to memory of 2620 2616 svchost.exe DesktopLayer.exe PID 2616 wrote to memory of 2620 2616 svchost.exe DesktopLayer.exe PID 2620 wrote to memory of 2560 2620 DesktopLayer.exe iexplore.exe PID 2620 wrote to memory of 2560 2620 DesktopLayer.exe iexplore.exe PID 2620 wrote to memory of 2560 2620 DesktopLayer.exe iexplore.exe PID 2620 wrote to memory of 2560 2620 DesktopLayer.exe iexplore.exe PID 1460 wrote to memory of 2532 1460 iexplore.exe IEXPLORE.EXE PID 1460 wrote to memory of 2532 1460 iexplore.exe IEXPLORE.EXE PID 1460 wrote to memory of 2532 1460 iexplore.exe IEXPLORE.EXE PID 1460 wrote to memory of 2532 1460 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b208c7d4544bf1518aa275d3b9b9650e_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1460 CREDAT:275457 /prefetch:22⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:2560
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1460 CREDAT:5911555 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5163359d682b280bc0b17d3c69fae45be
SHA19a38466f886443192baefef1ad77546e839e9d81
SHA2567eae63adcc3640bdf5e19e79cc7facf014357023ed68745be6729f3e5d861a89
SHA51230ae303ec57b6d88ddde9afeb6a6259f5d15442a27bb9287ce3f081e259cc55e2c6383ca28aaad0bfeac34d2488291860b56a53316b5ba86ac2b10c74c63c6f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f1b6cf1759d811e974be9b4ce937481
SHA1bd15cdc31ea6843b19b3d7fe0ca6f12fa8413b4a
SHA256c5f9e363db0a89bd0a174b535a45ca2a4e309efe86d7e1eab3cc47273172207b
SHA5122406a2c3d23fb01d6698c2e15c9b21fa1a9fc6a3ca063021543f3b94f5e609952f643d4cc1dc3deb40305b32d13e6696cb3d6bbde0a919a8f7b5fda01d2886ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bcfcd4f6aad3836ce04df7ae10058acb
SHA13b710dc86e05d9fb54f69f4602d1ee49f1a2fca8
SHA256df706769ce3cbd3b5abba500d5a277586f9fcfa384825531fd4f026c8c899752
SHA512500736a96871ce151ec4643ac57b5a00df911b4ea6f359f31b77083ebc00bf6c5283455c452174aec0e3d906797fa6efb43aa2885d6be5ba898dded1b8f8a45d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5efb257fc5994547ace2ef9b5ed36afef
SHA115a308d0ecb16be2a6c2a71b91684da4302c0086
SHA2561bc2f5a00c0adb4877b86db8760b66498fb4606b9b409ec3a98cd4024ee9e4eb
SHA512501cb1163cf82cc5db94003a4071508f915bd2ae08170aacc969da74fadb4d310c833ce3e7976c4be4ced965524d404440467c50ad1b0b057727bd09e0a56361
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf07dbf1730dfd6953ddf41a059f82ff
SHA1a99371ccee98c17adb982b08d137e351717b5fcc
SHA2562e4e962bffc62d0cdf46450985bcca8ff5d7b1ba8ab41048f213b79aa854304b
SHA51225e5590ce12f3d11b56d3a4defb69e7af196e4cb41aebeb85bac07b8a12b1d29f7244c6b0671240ed02e002778fdc9afb3574716ee573d536200a5d4b65865ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5112b9d68caad872ea5eaf73cca78ba7a
SHA113ef76268d5c30108d38a24b97a9b75402d0de6e
SHA25673d440f2b939fc7f594e63f52294360c39e30b9c0341ae0e8349af7720a12efe
SHA5124e2707ca00528268f7dfd4934df5ead4740266525905bd4ebd9e636db87155964830943e1972a721d13a21c27fb9905f683e8efbfea76c9dda7b031caefbc50b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527542668bdf1e43b703b7acbf978fa1c
SHA1dc52872cbe054075d1b86972440802a578b043f5
SHA256d3306aef1120a8d3fc608c3fc12c32799133033cf606c82d2c5ca70c2c509034
SHA51235c0baaaec7101c8118dee2fd566e274ddb1b9b3a5251dc8e31af6a17bc9b9ce00fc25e414d1b105a8bc0fe564041a40f88edd533ba45c301e1e10c5ecdad7c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bfc1aa204367d91099b4f9b836151e07
SHA1f0f1089058178c209fd300c6e16af30df5407a2b
SHA25620f31c50f65257f06471e3ec9e2be2ab09b0ec19fdefa981d1b3d51f07d1d811
SHA51212209edb3ab0c255b78a9170f10e64301af14c22dd85522bdfe1e9bfed53fe914ef0bfdace4ff11bc6eaf582ad12ea3001e22d3e7494598e27f5f190ce8eac4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58c056d9845eac263be7043ac504f3e3d
SHA102457ea12e3515f4d0b1ab757c86a169889dd987
SHA25613c19c746a6e7b079a0b6acb114b9ce761237b75d47656e143c3fc631eef20e0
SHA5121868384589b2d6a4919ded2ac9537e88632ca84daa8f308a48d77b1ef28c46ecaae274861444ac5103a2bb9893dff8a7dc76e4645d1f94258f5d42d5a3252e31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564257a574cf9631824ec97f5a1396889
SHA1fa68c3728afde84addd025d4bb9aa66e51f67df7
SHA2561157cff7f6581b055e62eca2ebc44f71979241707e2d0cc6f3605252db6c31d2
SHA5127c330990189ccfe7b0e10f537e9a3bdcc73638477315e8efe99d83ce9e331c1b7488f6bef99fc7f2c0d1baf60b39adbc64b226120e119094c7b10858d92507f2
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a