5449b61f82ab5037d0aeb8f899bd8e54819ca4bcfe1cbda78f01a3372d93a7b1

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 17:41 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98cdb25737278b9defbed48bf94d474e_JaffaCakes118.html
Size

31KB
MD5

98cdb25737278b9defbed48bf94d474e
SHA1

724ce4429664932c7c719123d11a2e087229b03a
SHA256

5449b61f82ab5037d0aeb8f899bd8e54819ca4bcfe1cbda78f01a3372d93a7b1
SHA512

f0f99811a753ebd7026920f0575c6696c25eb29d2a55b3782357644c788eb29ccfc5ccad5d501b71930878d1fbbb3e4333e283dc65fd3493ed7dcc0c78a93620
SSDEEP

192:uwn4b5nm2nQjxn5Q/wnQieLNn+nQOkEntwenQTbnJnQmSuxljeEYziMhNSS6sZN8:5Q/pRxljeXvu6Ad

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DFF66201-2362-11EF-9340-6EAD7206CC74} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423771172"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2924	iexplore.exe
2924	iexplore.exe
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE
2508	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2508	2924	iexplore.exe	28
PID 2924 wrote to memory of 2508	2924	iexplore.exe	28
PID 2924 wrote to memory of 2508	2924	iexplore.exe	28
PID 2924 wrote to memory of 2508	2924	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\98cdb25737278b9defbed48bf94d474e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2508

Network

DNS

cdd.net.ua

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

cdd.net.ua

IN A

Response

cdd.net.ua

IN A

89.184.88.6

89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

753 B
7.7kB
9
13
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

753 B
7.7kB
9
13
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

779 B
7.6kB
9
12
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

152 B
3
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

52 B
1
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

52 B
1
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

52 B
1
89.184.88.6:80

cdd.net.ua

IEXPLORE.EXE

52 B
1

8.8.8.8:53

cdd.net.ua

dns

IEXPLORE.EXE

56 B
72 B
1
1

DNS Request

cdd.net.ua

DNS Response

89.184.88.6

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0865422feebaef78d5f413763e5ae15

SHA1
db3092c0778aa3626e5e784563f5c0e94b8a8ae5

SHA256
da9bb56844e84272c3097470cc5e06a054c71130591d344178e2d50f712d85c1

SHA512
a78a6efe61fdb4fc2f90b1b182dcde805df6b52c5011976dc9a57dc7b90824a813d06391ddc653031d3e44a4a52d62e73da508c25e8b401c8e7cb262fb7c44b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b33faee55de3f99c1a2e5b43676a364

SHA1
53487267e787011fdd0ffbf5bdfe80b45c8acb45

SHA256
a3efa10645a20895d2bf9ad235f61764ee335fbb55fc6d7492f92634f1f6ab2d

SHA512
e9f20edcdcde4f9678ec21a5a5db15258d2fc07cd3ab21cc5041d3e8eb3fcbef639ee47885489d3bf2a3c48091af274944542328982de195ae0840bb270a61b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3967458c12fc21efcf4d5c83fc5c5ef4

SHA1
ee3076c13c6a5ef9a72e6d1a960e860092a58fa0

SHA256
8d8f7627a71bc21e8c699c7d39fe2844fd28891058e811f93195d6e5426f58ad

SHA512
88d41ed0634317a6c58b90bb2834c7a29eb68666f26bd7201e6e6d96e880de455410417bc25fe2efb3738c369c7964faa97a9ac24dbfb41f77f0a48b9f65be92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
868429a9a38c314544186bd677f7fd18

SHA1
c7f10ae75cd11d13fd710d42ce8048d358fd88fc

SHA256
d5fda250e2aacf565698561173f5ebe6f8c7a403789c01f8cfabb01a3c655b6b

SHA512
d6c90cd2c3c674a7b39cd66ff33a376aaa89e786acaf6821ea40309b395ebe2e2b67c9fc436340f2e4ea2fbf4ba3fd86e62fcb22a2e4531e3eed58766bcb33ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00da46fa92374fd77581bc026439f3b1

SHA1
02898f00772314e0dc63f8330ef199fc002ee8d8

SHA256
b954717ca034fcd1a7d7f5a1f34aafed22738b22f3eaa626f6408e8f760b4895

SHA512
f6162121cf6689c61f427351634a5716e5ba62c000c5a153848f873ed87d66df0207cc649374059c770a0b50de6dc976f952722b42c6ca58258d5446f276af9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2f80019b54614daeb5ae8e7020698dc

SHA1
d9daa59d88052ba8f27a79ec9220f914ffad06d4

SHA256
4f046cf9e4ba607af647f6e5d12c61635d1eb03b9d5226e3ae61f3ccb9142c79

SHA512
a2625d34fd337316503726cf34beacdb89dfa8f9505d5cf3b5cbace06262a8c45ff69652fc881901a8e30f44fe4dfe4986e9eb6bfcc5e1b9479773773c129ab6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0daa22fefec34d295ba92bc366d2c434

SHA1
7553daf84cb051e2542cbc0f52f1c2f3b67fda6d

SHA256
5c54cad2910c4eb1ce952bb5fbce90f8bc42b6212a3dd6f18cd493c7fe08cf69

SHA512
6fa03c02cabc46e471957694dc19761d801c00bf9785dd0bf557df437873f62b58f5c6ccdcd30662daae44d59d0d9880190b6d4cf4582889644d84e618936499

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72b8aa875009e55f66c8c1be3b8bf611

SHA1
807fd68f9a6e97fd94d07598030b12a1ba6615ca

SHA256
3f73f3842f6798f43fa23128e2e7dfa3846efbb0ae46da622a3c6a82d85c4310

SHA512
748e5e6f2a53190bbdf88d58972fe89d5843ecb7a3c2b327c11042e655721eb5cb038bbcd9a91ffdb4e479958157cd2801aacbae9632c65cf6e955b3054c5430

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1103.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar11F4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit