93cd3a1ebab60adc22999de167b50106506dad1e3de717465508fa3a00ddd19d

Analysis

max time kernel
141s
max time network
132s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 22:28 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ac272950226d84948dff16770cc8096_JaffaCakes118.html
Size

139KB
MD5

7ac272950226d84948dff16770cc8096
SHA1

474ab8463056717bba75c5bec69151414735897d
SHA256

93cd3a1ebab60adc22999de167b50106506dad1e3de717465508fa3a00ddd19d
SHA512

295f398cdedfb0a2aac2183b82658c7ff99c713b6a83d43d913dae8c6eb6e6d76893d9b598ec7fa7278de04ed4f2934fd2d084f99e2a6050339141f3f44aa0db
SSDEEP

1536:SZfnwXzTlpfmZsyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrk:SZW6ZsyfkMY+BES09JXAnyrZalI+YQ

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423011113"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3983CBF1-1C79-11EF-BB1E-6A387CD8C53E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0f9e74f86b0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000f4fb96ec7b95480417381efebd8016920bc26fb142b4600979c64d2b2e7b9e62000000000e8000000002000020000000c0bf035131ee03c4112797416b0f6efcb5d53fe0cdbe4f6b9e91be6f4c4c745390000000f253b42119947661b9c4d385aae61f8b612f849fcacc5103c842547a9a3cbd8f50a52eaf2413481b48561a190171d18e88dbd97cab23e5bbc9fba2c7ee1021872bd619f910233cee823541897b4a5e9a00bc3cbeb99dca1eb078cd968b5f150ddb5dd7a3554eac35666e9bcead156cdc6e06f611f09439111118f5e805a09f4c5e00c484ab823dee054a550afb1497c9400000009e747f6bdde4b2baf34336f4dc69abb062caf9c3ce25df235f0ca010ea080c63acf63845d7a4a9cfb10d090bdebd1e30c3a32a53ef05f5c8e7959fea76fd3ecf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000040157e57face9f9f9caba5ff09d7728ee787c1fb7712e38dfe525e771412b0ed000000000e800000000200002000000072c85db206258df994f42594f8329cfc81f65acef4554406c59fb10f439a29d1200000004fe2404dd8bfccda3887fce013eafae4bbf6ad9c329f15f39e2beb425590e75c4000000027bc0927d4bc1926359460e759ba585d2eff7cd9cca325ed57e7f7d276edfc3f0aaaa4e041270a0dbb62c1872e32e203f0aff07fddfe8860918d7b166489d638	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1868	iexplore.exe
1868	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2780	1868	iexplore.exe	28
PID 1868 wrote to memory of 2780	1868	iexplore.exe	28
PID 1868 wrote to memory of 2780	1868	iexplore.exe	28
PID 1868 wrote to memory of 2780	1868	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7ac272950226d84948dff16770cc8096_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1868 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

DNS

edu.cn.evyad.cn

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

edu.cn.evyad.cn

IN A

Response
DNS

bdimg.share.baidu.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

bdimg.share.baidu.com

IN A

Response

bdimg.share.baidu.com

IN CNAME

share.jomodns.com

share.jomodns.com

IN CNAME

share.n.shifen.com

share.n.shifen.com

IN A

39.156.68.163

share.n.shifen.com

IN A

112.34.113.148

share.n.shifen.com

IN A

163.177.17.97

share.n.shifen.com

IN A

180.101.212.103

share.n.shifen.com

IN A

182.61.201.93

share.n.shifen.com

IN A

182.61.201.94

share.n.shifen.com

IN A

182.61.244.229

share.n.shifen.com

IN A

14.215.182.161

39.156.68.163:80

bdimg.share.baidu.com

IEXPLORE.EXE

152 B
3
39.156.68.163:80

bdimg.share.baidu.com

IEXPLORE.EXE

152 B
3
112.34.113.148:80

bdimg.share.baidu.com

IEXPLORE.EXE

152 B
3
112.34.113.148:80

bdimg.share.baidu.com

IEXPLORE.EXE

152 B
3
163.177.17.97:80

bdimg.share.baidu.com

IEXPLORE.EXE

152 B
3
163.177.17.97:80

bdimg.share.baidu.com

IEXPLORE.EXE

152 B
3
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

753 B
7.7kB
9
13
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

753 B
7.7kB
9
13
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

831 B
7.7kB
10
13
180.101.212.103:80

bdimg.share.baidu.com

IEXPLORE.EXE

152 B
3
180.101.212.103:80

bdimg.share.baidu.com

IEXPLORE.EXE

152 B
3
182.61.201.93:80

bdimg.share.baidu.com

IEXPLORE.EXE

152 B
3
182.61.201.93:80

bdimg.share.baidu.com

IEXPLORE.EXE

152 B
3

8.8.8.8:53

edu.cn.evyad.cn

dns

IEXPLORE.EXE

61 B
114 B
1
1

DNS Request

edu.cn.evyad.cn
8.8.8.8:53

bdimg.share.baidu.com

dns

IEXPLORE.EXE

67 B
252 B
1
1

DNS Request

bdimg.share.baidu.com

DNS Response

39.156.68.163

112.34.113.148

163.177.17.97

180.101.212.103

182.61.201.93

182.61.201.94

182.61.244.229

14.215.182.161

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70303edadb78e3837ff3afc5e5a3bdd1

SHA1
d9917bc882a853a325cd9fe8fdf94510b86890ed

SHA256
ee58213133a93845b519c125f5f9da80df384ddc982166b6a93c09334c82e4d6

SHA512
894c998b6fc19b77b3c16f4d9505a7a2a0c5a913bec27eb7abd12f1299d8b363e44728eabc1dbf91759b108b9f0d5e6c7451c8dcb608cd90d6cc43a821f7836a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c0782f70a1dea741a02589a52fb90de

SHA1
da9c18fdfa9eab7c6302eb95d0bca4115e931ac0

SHA256
96a4427c597365e42f13107b6a58ab4a3424d3010e44a30754b9e38c053de9f8

SHA512
65a2b1c03f56194c6ca90f1c36970f460bfb3dedbdf0364f7803df07339792d3c0d47faca4056048d3e4478de6b28ab80f95c73c3736549e970708d9bd4477f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e19c083919b6345f35d2f6dc8ebe265e

SHA1
9a1647a87c90428ffb513d84409770174b34f222

SHA256
84bb0e9a60d72bb4e95a60333a9f9f373699e4eb9bb228b5822c1135b4853623

SHA512
c91287e1758cc52ff372043b56370a17e89ea73ae30887f976f089d81fc7e88b8e80ec9cec754f6160743adb70b93c983765ecbdd6e9eb01e08816d43d977037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c0b9fdab3e53f563bf92d3e111da8b0

SHA1
9f286234819669ac5ad8b10b9ea07abb50bb2450

SHA256
ed176f1541461a1448025d5d56eb0e9ac8ffbe11abad050883d5a83ff295cd93

SHA512
59448e3ad9ca9942d72dc0cb3e587b5666c9b67266faf399ee0bf07932c69f99f3522ecd71b4af8768ce3aa4d7ed0b10c63b65a6bd8a1cb0e121e0f393068a0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78964f83a82df48865904ea93f497060

SHA1
3e96723adc3b1dadd23c6a25f11b79f06a9811c1

SHA256
64b4e6818ce452917fc6da64799ce7cf2eb8bb45bf801aca18021e260800e0f6

SHA512
9a11a414c64a15fbc7f60a157d21068290619b9030ce6ac62fc685e1739b2b4dda92491f6b65b2b852259ebdd42dae97aaeaaab623acd5ac69d02238573e591f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
089422378bc2162926776e1822e4e3b8

SHA1
065e3baff41587147fb116b647e2d6b488a67b39

SHA256
53305b7aa72fb9811bfdc5cbe74941b466f026124f1181f1ba73774b230023a9

SHA512
999cc06e765d18baff90cdb0611969589ab2d60470de71b9afdeefd01341fc5100aa681167a6b6709f29f2595135cae202043dca3eda7c9e22243e20835b0897

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e161213dfa766c18ea1125e0323642c1

SHA1
30a649db8f4e3d12c767b1fb6cecbd59c1f066de

SHA256
b1b96308128407d2655a69ba817116267c3b5454b64049c9d665882c5fa28ee5

SHA512
5e41c7198f79c0bc8a2ff59b1fcb55e14e8004953901897c979e494d7837615c631ac6a141df006399bab360199772ef3e707fcca7f71ff434943b077b425249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37e6429e0096c145bd1e231b8a501f68

SHA1
1d719768a9a5a94f1483623147e219dbf73cfbf5

SHA256
5b713d0579d43379cd0aa3eda725e1abadd66dc9360b76dcdeb0be14761bdbee

SHA512
e92c31802237f680aa8a20da1e811626a2c7d6a4592302cc78f2683437c1459a3dccaf288e936ea871325684abbe7d1a5dca6fc575ba94de141b88eaa0135905

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
73d74679ea0868710a3cb46b334fd399

SHA1
d9f04a058f66c48272b2e31dbffa132c6f3ee090

SHA256
c922a9ddc47e6d009ead7d0033db4c2ca70568fe0e372378a04d87c510545049

SHA512
9186643ec233e14c8d27b5b01c9ec85af8e8e18372262fe70c812c029e5465420e3e226f27690633e356cd367f5d3bd3e2470077633a48f99d5dfb6b0afa3aba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1077.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar10C8.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit