13e4448e711c5ed2069a7e1c590c8b3d6492e5438f9dafbdecd96bb6a76f2bc0

Analysis

max time kernel
148s
max time network
137s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 15:43 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63d500cc37bdc02b2780206f073b4e64_JaffaCakes118.html
Size

18KB
MD5

63d500cc37bdc02b2780206f073b4e64
SHA1

334e616f63fd3b0da3b2bced7c8071aee6eeaf93
SHA256

13e4448e711c5ed2069a7e1c590c8b3d6492e5438f9dafbdecd96bb6a76f2bc0
SHA512

4126c8ff861d6f07b2a6117ee1abce45e81a6f06431d82b12572194bd7eed45e62947297d663fbe6b148c8161324b42dbad268676d07df8bfbbbfeb2ff90c557
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIaqu6qT4PEU0sqh2XEzUnjBh3Mf+82qDB8:SIMd0I5nvHLsv81xDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E39C09E1-1788-11EF-8C92-6A2211F10352} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422468084"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1368	iexplore.exe
1368	iexplore.exe
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE
2324	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2324	1368	iexplore.exe	28
PID 1368 wrote to memory of 2324	1368	iexplore.exe	28
PID 1368 wrote to memory of 2324	1368	iexplore.exe	28
PID 1368 wrote to memory of 2324	1368	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\63d500cc37bdc02b2780206f073b4e64_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2324

Network

DNS

img1.jiehun.cn

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

img1.jiehun.cn

IN A

Response

img1.jiehun.cn

IN CNAME

img1.jiehun.cn.a.bdydns.com

img1.jiehun.cn.a.bdydns.com

IN CNAME

opencdnspy.jomodns.com

opencdnspy.jomodns.com

IN A

106.225.194.35

opencdnspy.jomodns.com

IN A

61.170.103.35

opencdnspy.jomodns.com

IN A

61.170.99.35

opencdnspy.jomodns.com

IN A

110.185.108.35

opencdnspy.jomodns.com

IN A

111.225.213.35

opencdnspy.jomodns.com

IN A

113.142.207.35

opencdnspy.jomodns.com

IN A

121.14.135.35

opencdnspy.jomodns.com

IN A

124.239.243.35

opencdnspy.jomodns.com

IN A

125.74.42.35

opencdnspy.jomodns.com

IN A

171.107.86.35
DNS

t.cn

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

t.cn

IN A

Response

t.cn

IN A

39.105.18.168
DNS

www.googleadsl.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.googleadsl.com

IN A

Response

www.googleadsl.com

IN A

170.178.222.41
DNS

hm.baidu.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

hm.baidu.com

IN A

Response

hm.baidu.com

IN CNAME

hm.e.shifen.com

hm.e.shifen.com

IN A

183.240.98.228

hm.e.shifen.com

IN A

14.215.182.140

hm.e.shifen.com

IN A

14.215.183.79

hm.e.shifen.com

IN A

111.45.3.198

hm.e.shifen.com

IN A

111.45.11.83
DNS

www.jiehun.cn

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.jiehun.cn

IN A

Response

www.jiehun.cn

IN A

61.160.251.208

39.105.18.168:80

t.cn

IEXPLORE.EXE

152 B
3
39.105.18.168:80

t.cn

IEXPLORE.EXE

152 B
3
170.178.222.41:80

www.googleadsl.com

IEXPLORE.EXE

152 B
3
170.178.222.41:80

www.googleadsl.com

IEXPLORE.EXE

152 B
3
106.225.194.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
106.225.194.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
106.225.194.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
39.105.18.168:80

t.cn

IEXPLORE.EXE

152 B
3
170.178.222.41:80

www.googleadsl.com

IEXPLORE.EXE

152 B
3
61.170.103.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
61.170.103.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
61.170.103.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
61.170.103.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
61.170.103.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
61.160.251.208:80

www.jiehun.cn

IEXPLORE.EXE

152 B
3
61.160.251.208:80

www.jiehun.cn

IEXPLORE.EXE

152 B
3
183.240.98.228:80

hm.baidu.com

IEXPLORE.EXE

152 B
3
183.240.98.228:80

hm.baidu.com

IEXPLORE.EXE

152 B
3
61.170.99.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
61.170.99.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
61.170.99.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
61.170.99.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
61.170.99.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
61.160.251.208:80

www.jiehun.cn

IEXPLORE.EXE

152 B
3
14.215.182.140:80

hm.baidu.com

IEXPLORE.EXE

152 B
3
14.215.182.140:80

hm.baidu.com

IEXPLORE.EXE

152 B
3
110.185.108.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
110.185.108.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
110.185.108.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

747 B
7.6kB
9
11
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

747 B
7.6kB
9
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

831 B
7.7kB
10
13
110.185.108.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
110.185.108.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
14.215.183.79:80

hm.baidu.com

IEXPLORE.EXE

152 B
3
14.215.183.79:80

hm.baidu.com

IEXPLORE.EXE

152 B
3
111.225.213.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
111.225.213.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
111.225.213.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
111.225.213.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
111.45.3.198:80

hm.baidu.com

IEXPLORE.EXE

152 B
3
111.225.213.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
111.45.3.198:80

hm.baidu.com

IEXPLORE.EXE

152 B
3
113.142.207.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
113.142.207.35:80

img1.jiehun.cn

IEXPLORE.EXE

152 B
3
111.45.11.83:80

hm.baidu.com

IEXPLORE.EXE

152 B
3
111.45.11.83:80

hm.baidu.com

IEXPLORE.EXE

152 B
3

8.8.8.8:53

img1.jiehun.cn

dns

IEXPLORE.EXE

60 B
294 B
1
1

DNS Request

img1.jiehun.cn

DNS Response

106.225.194.35

61.170.103.35

61.170.99.35

110.185.108.35

111.225.213.35

113.142.207.35

121.14.135.35

124.239.243.35

125.74.42.35

171.107.86.35
8.8.8.8:53

t.cn

dns

IEXPLORE.EXE

50 B
66 B
1
1

DNS Request

t.cn

DNS Response

39.105.18.168
8.8.8.8:53

www.googleadsl.com

dns

IEXPLORE.EXE

64 B
80 B
1
1

DNS Request

www.googleadsl.com

DNS Response

170.178.222.41
8.8.8.8:53

hm.baidu.com

dns

IEXPLORE.EXE

58 B
164 B
1
1

DNS Request

hm.baidu.com

DNS Response

183.240.98.228

14.215.182.140

14.215.183.79

111.45.3.198

111.45.11.83
8.8.8.8:53

www.jiehun.cn

dns

IEXPLORE.EXE

59 B
75 B
1
1

DNS Request

www.jiehun.cn

DNS Response

61.160.251.208

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f27d897517a078f3873be8cea03757d5

SHA1
fb3b200017f2d0c2267b7edcb93e809366f59c3a

SHA256
c5d629a7d83c3526226d8bc0259462fa460c50a0c18482820f9b891b4626ccbc

SHA512
b2572bd253b95d1f2054f47ca3f508fb9a5d850789629107e69d5143723d6cf218e1f053c49893469474c872b143c9080781e4e79698d5d55ccbdab55fc17bfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2e4f6bf2bcca9217f65ac9ed35da436

SHA1
85b8ec40f3f1c8b9455953a9bc7718e051cbdac6

SHA256
2161b3a116fcc118597bccd81bac2e67f683a552f544dfec0c26195824e0e760

SHA512
a94ced95b9b954e0b2fdb7ceb1cb127e3fbaaf8c64580f54acd53500679f0946b2bba9a3fff4352a202bee2134b887317e7af86dda781e4db1fb1c1847077580

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fd2f191269f69c65b20c57ae13f0c04

SHA1
acbdac7ba960bd981c2db738ba6f420dd7299326

SHA256
906875710e7c376bfc086c7a2fb396f3cf4ff8b8961f9d38dea42ebaf0ad22ee

SHA512
e23df95f7ffb51ff72850d6566e55c215596d678e80c0009e96d154578c6d6f92aa36702c283e51dba920279cda34ff0b394685562941190cb4b349b0e333ea4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fced09841a0504af71b03aa57821e6cc

SHA1
f7e1a75c145d8cafe6c08516e21ae46503012043

SHA256
9a1da159bf27ebfcb92280755655ba6208accf4f2154db6ab4f2d20d404aaabd

SHA512
9bbb6532d3844337ffdd93c9465678cfa983492af5840553c4c0438a9fcd7c306af1be0848c6e6afd6c4a0cc37bf576613023fba4775777d17e7f77bc1a8822b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd5c5934b0e8056e2d41e202fe6ec37d

SHA1
494e275ae5cc9d0473d4bd3ece0a78ad24cc58d4

SHA256
9e958d3346355a3cd0694a1278f472f62eb23a6f3d0b46a00ff82e547a5a3111

SHA512
5c6318e9dd3537b9dbbbc80d3d821aefcf7a15e698444ec0c097d081eb41170af0fd1eac462252139065004dadaafe72f66d769abb264ce42bb3107f2fc919f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ddcd0bed285a87a45cf1538299d820de

SHA1
89f3db5085b4ad6a7a7e602cb79eed7bdb9f5b54

SHA256
0e0fa669db167dcd976dc4264814087ea10fc107402486b813cee208531c5c67

SHA512
b7afb2ab9a1d9468cf5eaba5ded2791b38f123dbcdcd9cd5dd5b1dfd993fece58ea3bf9ea8cb9cf09115fb7dd112578a3e1aa28e2d1cf53e60f5ba5ba1deb990

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da713baa3220634c311d59d7c2e5a81f

SHA1
e1624729e0f6eb83046023bef753a2d4c306c428

SHA256
9a9767be9d27d567ffec12ae67037436b75e82023db9f7bebb6326d1f1c64a8c

SHA512
c14c894ea3a54da39674716c62fd032b4daceecf5afc94b45b21c03e52723ebc556d6c07511cbe2b57a0b1c15e0654f97da9d0003a3505a821f7881fdc848d02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9982dccd28424580b3167c2f9e7ae3cb

SHA1
7ed0019509f2949b063926dd36909e932923eacd

SHA256
5be0183aac62e5d316fde422fa4c6f899b92f62b1279bd5012871f0e9dac1aae

SHA512
6a9cd8a56ccb5d8af909eb8a5d9bc0dc1cea8fb3c8ae29acb28ab22c8641789286505a0d52fca986a215c32094e1ed12db073c575849787deb76bd35173e9283

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66fcdba83eb67faa45cc218185ba4c39

SHA1
f5405dbff807dd96d4d1e43f564551d83719241d

SHA256
ef5a6b4dca5da67a29db86817f37bce4f4f88ca363114d08564dfd81d0109af6

SHA512
4e939c088aa0bb66d978257749b09e0c1758e6098949b03e9ee2a9dcb6eebca3ffbef870a83380cc10ea1beba8c9adaa66cb51003c4a6b4f25e2062621a02f9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2232.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar22A3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.