1f7574a0db44315a31c5dc9d87f4c64c4a746b1532aafd209d58b1b3c262eb48

Analysis

max time kernel
119s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 11:17 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

677d0e269ab9cdfe860f3c2d53335638.exe
Size

41KB
MD5

677d0e269ab9cdfe860f3c2d53335638
SHA1

2617cef597abe21abfb7095bf5fd7e4c37c4e80f
SHA256

1f7574a0db44315a31c5dc9d87f4c64c4a746b1532aafd209d58b1b3c262eb48
SHA512

ef14f2d796e14c13180267949fc4daa110de2b153529abe9302b2e26213dcf63e32bceaa92a66288968b568e823b322b168c74444f3b37156f68a1ea56f8a0b5
SSDEEP

768:WC5qVQgwBcxcYeUmoL76iP98LhyvXW7yDyUtcZQ4ktPdv7T8x:R5qVQyh9j7EhyNPD7v7Ax

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411824939"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{61B52B51-B6BC-11EE-8568-DED0D00124D2} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f012b237c94ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000000ca0499f78c3fbdc58fbe0f5d534009e2a43abe1e4ba0ae0d405349dbd6d1bf2000000000e800000000200002000000069998e0772c51d586981acd200eb2309a9493faa9fa2af73b18689dc336240f420000000452861fd9193e840e35c56d26dada6d1be3366c1b3e6e2b9643d080a73cad69d400000000f77c68ddd18de955aec27e50e6802f06463dfb56e30d27b15be54cd55419bfcdb57fc8539ab9ad7fed19a7ed40989563f47f297bcf10664331642ae65910e4e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000007d8077b06941dd64074f8f5822af61dc6d4b63e6fbefdcf11e4cf80d2a273354000000000e8000000002000020000000a7158b9e9a0566bfa0a25fed062d6c8f197c519f95442e4984d6c771f998f7ea9000000016cc95cda7eade728bc54d025d519235c2f132b8caf78d57624a7b9107bb15c13f0a1fea91a7e03a6549cff237c8cd846cd07d7c6f3a5bde0d7acd9c07c643da6bf13079d51a18f09f91683bf05ec4692485c8a5fccb2da7d7079f7ddb494950cf2cc4e118978526442ae371dc2b10656172e9e177db3cc134b2cd2dae9f829012beb2a4dc79dcc7dc9c269a1238a5ee400000005f6262206cd3df0544d2dd022151654209ad05ab7a0f11d17235d6d3eb7c909e32ddcfbc8802c0454bf76c5f420fcb0f81450b429c6a1637f000d9d1c034fa40	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1184	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1184	iexplore.exe
1184	iexplore.exe
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 1184	2956	677d0e269ab9cdfe860f3c2d53335638.exe	28
PID 2956 wrote to memory of 1184	2956	677d0e269ab9cdfe860f3c2d53335638.exe	28
PID 2956 wrote to memory of 1184	2956	677d0e269ab9cdfe860f3c2d53335638.exe	28
PID 2956 wrote to memory of 1184	2956	677d0e269ab9cdfe860f3c2d53335638.exe	28
PID 1184 wrote to memory of 2868	1184	iexplore.exe	29
PID 1184 wrote to memory of 2868	1184	iexplore.exe	29
PID 1184 wrote to memory of 2868	1184	iexplore.exe	29
PID 1184 wrote to memory of 2868	1184	iexplore.exe	29

C:\Users\Admin\AppData\Local\Temp\677d0e269ab9cdfe860f3c2d53335638.exe
"C:\Users\Admin\AppData\Local\Temp\677d0e269ab9cdfe860f3c2d53335638.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://google.com.br/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1184 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2868

Network

DNS

google.com.br

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

google.com.br

IN A

Response

google.com.br

IN A

172.253.116.94
DNS

www.comunidaddde.kit.net

677d0e269ab9cdfe860f3c2d53335638.exe

Remote address:

8.8.8.8:53

Request

www.comunidaddde.kit.net

IN A

Response

www.comunidaddde.kit.net

IN A

201.7.182.206
GET

http://google.com.br/

IEXPLORE.EXE

Remote address:

172.253.116.94:80

Request

GET / HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: google.com.br
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Location: http://www.google.com.br/
Content-Type: text/html; charset=UTF-8
Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-D7WVapHGwSkISh-QativFQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
Date: Fri, 19 Jan 2024 11:17:53 GMT
Expires: Sun, 18 Feb 2024 11:17:53 GMT
Cache-Control: public, max-age=2592000
Server: gws
Content-Length: 222
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
DNS

www.google.com.br

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.google.com.br

IN A

Response

www.google.com.br

IN A

209.85.202.94
GET

http://www.google.com.br/

IEXPLORE.EXE

Remote address:

209.85.202.94:80

Request

GET / HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.google.com.br
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Location: https://www.google.com.br/?gws_rd=ssl
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-DS59bq7SbN3FCzw7FcZ3Aw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
Date: Fri, 19 Jan 2024 11:17:54 GMT
Server: gws
Content-Length: 234
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=Ae3NU9PU8-BMWPdCKQ8ZkeqXkYOIRI_emkq-jUpSJGWIOeOtoWlV_GxmPg; expires=Wed, 17-Jul-2024 11:17:53 GMT; path=/; domain=.google.com.br; Secure; HttpOnly; SameSite=lax
GET

http://www.comunidaddde.kit.net/jumper.jpg

677d0e269ab9cdfe860f3c2d53335638.exe

Remote address:

201.7.182.206:80

Request

GET /jumper.jpg HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.comunidaddde.kit.net
Connection: Keep-Alive
GET

http://www.comunidaddde.kit.net/dllhostc.jpg

677d0e269ab9cdfe860f3c2d53335638.exe

Remote address:

201.7.182.206:80

Request

GET /dllhostc.jpg HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.comunidaddde.kit.net
Connection: Keep-Alive
DNS

ssl.gstatic.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

ssl.gstatic.com

IN A

Response

ssl.gstatic.com

IN A

209.85.202.94
DNS

clients1.google.com.br

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

clients1.google.com.br

IN A

Response

clients1.google.com.br

IN CNAME

clients-cctld.l.google.com

clients-cctld.l.google.com

IN A

209.85.202.94
DNS

apis.google.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

apis.google.com

IN A

Response

apis.google.com

IN CNAME

plus.l.google.com

plus.l.google.com

IN A

172.253.116.101

plus.l.google.com

IN A

172.253.116.138

plus.l.google.com

IN A

172.253.116.102

plus.l.google.com

IN A

172.253.116.100

plus.l.google.com

IN A

172.253.116.139

plus.l.google.com

IN A

172.253.116.113
GET

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.GsbA68hXs80.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo899t-H8Lxb3OqzMDuPn6TV_i36ag/cb=gapi.loaded_0

IEXPLORE.EXE

Remote address:

172.253.116.101:443

Request

GET /_/scs/abc-static/_/js/k=gapi.gapi.en.GsbA68hXs80.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo899t-H8Lxb3OqzMDuPn6TV_i36ag/cb=gapi.loaded_0 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: https://www.google.com.br/?gws_rd=ssl
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: apis.google.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access"
Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
Content-Length: 41131
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Fri, 19 Jan 2024 11:17:50 GMT
Expires: Sat, 18 Jan 2025 11:17:50 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Wed, 06 Dec 2023 17:20:24 GMT
Content-Type: text/javascript; charset=UTF-8
Vary: Accept-Encoding
Age: 6
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
DNS

www.microsoft.com

iexplore.exe

Remote address:

8.8.8.8:53

Request

www.microsoft.com

IN A

Response

www.microsoft.com

IN CNAME

www.microsoft.com-c-3.edgekey.net

www.microsoft.com-c-3.edgekey.net

IN CNAME

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

IN CNAME

e13678.dscb.akamaiedge.net

e13678.dscb.akamaiedge.net

IN A

173.222.13.219

172.253.116.94:80

google.com.br

IEXPLORE.EXE

190 B
92 B
4
2
172.253.116.94:80

http://google.com.br/

http

IEXPLORE.EXE

524 B
951 B
6
4

HTTP Request

GET http://google.com.br/

HTTP Response

301
209.85.202.94:80

www.google.com.br

IEXPLORE.EXE

190 B
92 B
4
2
209.85.202.94:80

http://www.google.com.br/

http

IEXPLORE.EXE

580 B
2.0kB
7
5

HTTP Request

GET http://www.google.com.br/

HTTP Response

302
201.7.182.206:80

http://www.comunidaddde.kit.net/jumper.jpg

http

677d0e269ab9cdfe860f3c2d53335638.exe

471 B
128 B
3
3

HTTP Request

GET http://www.comunidaddde.kit.net/jumper.jpg
201.7.182.206:80

http://www.comunidaddde.kit.net/dllhostc.jpg

http

677d0e269ab9cdfe860f3c2d53335638.exe

473 B
128 B
3
3

HTTP Request

GET http://www.comunidaddde.kit.net/dllhostc.jpg
172.253.116.101:443

apis.google.com

tls

IEXPLORE.EXE

700 B
4.7kB
9
8
172.253.116.101:443

https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.GsbA68hXs80.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo899t-H8Lxb3OqzMDuPn6TV_i36ag/cb=gapi.loaded_0

tls, http

IEXPLORE.EXE

2.0kB
49.9kB
27
41

HTTP Request

GET https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.GsbA68hXs80.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo899t-H8Lxb3OqzMDuPn6TV_i36ag/cb=gapi.loaded_0

HTTP Response

200
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

747 B
7.8kB
9
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

747 B
7.8kB
9
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

831 B
7.9kB
10
13

8.8.8.8:53

google.com.br

dns

IEXPLORE.EXE

59 B
75 B
1
1

DNS Request

google.com.br

DNS Response

172.253.116.94
8.8.8.8:53

www.comunidaddde.kit.net

dns

677d0e269ab9cdfe860f3c2d53335638.exe

70 B
86 B
1
1

DNS Request

www.comunidaddde.kit.net

DNS Response

201.7.182.206
8.8.8.8:53

www.google.com.br

dns

IEXPLORE.EXE

63 B
79 B
1
1

DNS Request

www.google.com.br

DNS Response

209.85.202.94
8.8.8.8:53

ssl.gstatic.com

dns

IEXPLORE.EXE

61 B
77 B
1
1

DNS Request

ssl.gstatic.com

DNS Response

209.85.202.94
8.8.8.8:53

clients1.google.com.br

dns

IEXPLORE.EXE

68 B
124 B
1
1

DNS Request

clients1.google.com.br

DNS Response

209.85.202.94
8.8.8.8:53

apis.google.com

dns

IEXPLORE.EXE

61 B
178 B
1
1

DNS Request

apis.google.com

DNS Response

172.253.116.101

172.253.116.138

172.253.116.102

172.253.116.100

172.253.116.139

172.253.116.113
8.8.8.8:53

www.microsoft.com

dns

iexplore.exe

63 B
230 B
1
1

DNS Request

www.microsoft.com

DNS Response

173.222.13.219

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
41a0bdd7bf986795b2321dd5a4e57ab2

SHA1
d396b0936339e71b1f296e4a6c86731f6646542e

SHA256
dd3e3d343bef9427be855f9a4b71848ae14f4ab12d13432487a1dde15313f5af

SHA512
8b6150bff93296ca7bf255e1abb6cbf12e05c643d4c6f5a0a55d2173a325a5692aecc8d73e43cc5e81d24bec5cfff6573a1cd5640b8f53ed5aed3b0137c730f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a43e5b94892d9a64412fe03ec05aea2

SHA1
7c34b63c828fa4e237184315bddb81f1b6c8c49f

SHA256
0aeec0ea5962fb2c4fd497e01ee740c49fdf13b8a0678c0f75308a044834aa31

SHA512
07cbb27502b8a7a9236ddd296e82c2389b090f658c404794e4e05d779ed92ddc58dad3ebaf5bd3441b8a60f81af6fbb428b30db7817017ecd926a5d430061bc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e4c3a3a05414a9df4aa49b58b2afa58d

SHA1
b181b6ce83ebc86540327d76b5da36ef066f7e2a

SHA256
cc235a192453185fbc11932a408f8ec5bab66b308a57164876200dc46f689bb7

SHA512
8726d64cf01ccdf3bcb31eb3e8197244f13bde19874e7eccc7741aa8105432f618cabc79e7fd735c992a4931b4a05ab671e1147524177db262d3ea54357b2dc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25c7efc4be7e424db70bc3359d30dcda

SHA1
cee74674ba5e2f38cd9a963be41fe49f66a6d08b

SHA256
812514d98993e2b18da6e4ad3576893fedb70c875aaf92fdc34ce62bc37a61dd

SHA512
f2bf77f531fd6ad1886a76a0c7bd4d4367cdd58936a99f2f6bce13434c72adff1081f5b38df1c1debadf454f75e485c3155e6b215740f8db8867e1b793d83c59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b429cfdafe6656316d3cbba8be7dee7d

SHA1
6620267d7ee8d9ab63e3155963e45580808d7dc8

SHA256
aab937ea386ff7c713c4177f62867f11388ee1249418d4bfdd3efd9b1adf67bb

SHA512
00b6972ea26e873f4ae6cc096372fe1f225ee848947646f60b74ee335ba4c90d030a1e67630080e54216ba302a9f2c7278a363f6bedce0714b051b68bf3d2720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da02c268302899afd8e429126acb267a

SHA1
d0fbe9e49af84d84f486f8eba5aa443f3398eee5

SHA256
798a121f3fa883d43e25d9ce948518a500e0573049aec0a3796af43ccc9d18fd

SHA512
8ddbd94bd6580cd10ff3a07206d92c81d9b32f3a2495896a9689f53b5ddba4693d792847b624b195317b0757263013f37f2fc0ddfb4fe6837a5e138d75e666b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
343f0e62e855033a98dd2852852224cd

SHA1
0f5a494554eb3a94af01ec1b762344dc0de42f20

SHA256
0c99afed635e26c092341af4dd3cb37702f27b4b5dbe9c6d7214d5e84609ee92

SHA512
e4dde3b143a4865b89fcb59674a8e84031bd3e09204914b6f4071eb369b6f5ed016b5c0a6972121999e0a3e8b2ff4cf38b795b2d37ee013c7dbb32383e7b8e0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0c2dfba449a38c5b187062fbf3a56df

SHA1
3fabd3085fab064ec8cf305360de8b5ca6a08787

SHA256
98ecb7b29c985593ccc78dd845234c3574794ca0c3b975176fe86ca276260f7e

SHA512
7ac4916f632cfbbc074e56d7134802b40f7c976ae011e3d0bc4e40cf53534e5cfbc825c935a623bb3517d97d07c61b4431d0d5b650bea55c6054dd4135c1a811

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca94ec17626c373310dd283e6e598ec4

SHA1
1169b934163fb6103c4a7617d5b18786ecb57b63

SHA256
2220a5559a30ee4e0e7da4f93a6a8cf40c3b590364904ffb0b84361c634d24ae

SHA512
fba5438237c420701813cefeb29ccb267d301ec052443542bc96956057d6bab19dfc0542b98ab01995263114b6fc33e2dafb54ffd1aef4653613c422a86b31f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
250c667c54eafe07eb6f3b835793a9cf

SHA1
68ba7efdb251eef05984140af4e4199f99e8117c

SHA256
0d4b1ba25298d67b00acd508d73526acab95a10cc0b0264ff99b18876532411d

SHA512
57357153edc10434c9aba4cd46cc87e95cc6dcba9fce7d2858e3325b6c25dd6337128f2034eba37f1ad859859521045330f086ca3856942feb8f615492fab156

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aa2b8b95a7c16a95f340a2c0dc8d8f85

SHA1
a7970f304a8cd18e28210962d5c36dd1c1979894

SHA256
5d33dd371fffd18561eed4fd90e3bcb44af2567dc4687f284328293cc760c7b0

SHA512
27be218a85f42dc30f55b7bb2a522b0f4a33bbd502c1ba8b140318e819a947950ec0a7d748a50ae3b0df158fca79caba3008a6c5ea885f94f3fc055cfea8d497

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9d022a7a6ba742ed12305ce7d8269b18

SHA1
6becea056d2b6a32a794774cc63be01393d8aba7

SHA256
8f7903ed04ead35a9616a00495ba5286f436838e41631c304f47b888ab5325c9

SHA512
bf216a5582e0dd6d00bc49c4e1b7c32e3f829a94691fd303e1a6ea2daa493766d22fb48719087fa9f31a77333e30d083cc9b759b19fbd333ef8492bbd02550b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
aff51e28c98c739de3113a9d3a0cae8d

SHA1
3e75ce2425b8138d46273866ccc29f11c7d97f84

SHA256
e1f0b4378151551e5d938894ab5c40957e589bdf3a41024d044809892df41e6f

SHA512
713c23dd66ff41aae02e002bf9bd4a34e36a552ba91daa98770aee34a858b1a4492cc3705a4248b37130313449a6f116f7abffa02b92e6a3a44da9177e114e44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cd454db6d791af847b018cd9855735d

SHA1
9927c3d71d0d1cb237b2eb5a4f20f297827fbf17

SHA256
23ce0879f63652d009a0f2c7f893154f620bb126321148825b6c78cd5b043058

SHA512
25e4b670952701d859fd22b428b581bb3405f0e7e7f40c7242679ae613dc1a9629505aef3a92ce1552849591cb3c9f599eb6e04f463e446a0548157d1bdced44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8c14d66e8d514baeba34f8da3d293dde

SHA1
832787dfbad3b3cb878d79941e050cbdac5fc22a

SHA256
4fbee84f434dbe6d2fa6dc5ebe1bd097dc6452a90ce8da10e8f32f439f834082

SHA512
9178f0f22f54eea1d693632d98f8b832c09cb1b00f4a0ddee6ef68db791446eab7ffcfc925906b7739c92d291fcf81494c831157bd84c0111cedd55ae6d9c8b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4701de138fead098fa554ccfd79788ac

SHA1
72d626e3d7435f14fb8e7135322e626958c5a624

SHA256
b736923055549534dd8ca4ed6bac88dcca7bc870727bce893e50af40b3e17396

SHA512
3bcae8f32d2f38cf023307b47f7a14418accca6bd982802718ba241f7641197d65c3ba1087b01112ae55547c9d5c020dae0741cd81b360ae09975e89f898a4f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e0d2d32a1f7cde8feefb2c26c54e59aa

SHA1
6543e3685bd8058c63b1e50c7cc32478f5458cc2

SHA256
caecfe1a2ba1d5f01c66518827126b22f251c56268d54fab4c57680abaa37eff

SHA512
7f6697ba11026186b07938d3c1854b45badf9eed110e17e5dce306882b61e0e3559c134544bfe0dbaf72fceda4fdb10d334598200d56d4c7d0ed12dca7aa964d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfa3752693799c8e8435f0aac31b5c1d

SHA1
256b2c4eed37b45187b0ec3acca2d9b0cd6f6c2a

SHA256
b84a99aab192ed6e94761b0889525c1a7d837f068fa74bf8656bf1aac94393e0

SHA512
cafccfbaceda84edf0159bf3ffab69c8e09064e1f128108b304b7378cdbbc9ea3f76e86afc60769f37f8262035d7d832cdbb55a0590f3b51f842efe3edece5af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d027cef00ebc2865199ee4eb36f2158

SHA1
a0e83d01464286de7d6535b9e3a0bd62629ed4aa

SHA256
021288051bae823bb885dc6c283edd8868baa488e801813eadd34453fd55094a

SHA512
561e97d76d93ef7d2a4c1bed6e68e5ebc7cff80f3542dfd5bced9ca5433e06e2f0b6051353b7e7cf2e5c8f2fed681a2d5f2e15ccb9cbd2434d9f34754855f78e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4439cfe1ab524cbbd5164cf4b17f834

SHA1
f71d67b7ccc9a84aa1fc4be22f2755e5f2e45f01

SHA256
4a7b1f52bc51777c90ff47645e5beadb6e3ab496700d529877175c91768539f5

SHA512
ff6685fb12d63c31c37f337e4d670753ae0d0fd5cb760d54fe6f8e92565d2b1cf96e793424af56f73acdb5cfdd87754f5514df7dbc5e6dcb6591dcf420e30824

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
9c8d119b1d2f9bfa242a46f85a267d1c

SHA1
6b402b283dff01deb96d0142077844f6c2b5d53c

SHA256
d97403c73bb08ad59d8391615651712d737d1fb0339a5c05643bba2210bdf281

SHA512
b1de49b89fe61d4f06172ccb65e43f95ce6c1087ea7e0d96aea3cd2384e37d27076af400df90384e08c2bcd87056836546a709c6804245b58b113f352a6611c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\f9yyw0t\imagestore.dat

Filesize
5KB

MD5
84a26f6e566947e5a106a5b71f1a0b4b

SHA1
5b6a85ed4946e45b5dc82dfa4947560b7e44f202

SHA256
a61558ed235b99c0e741502741fb3b122c587abf73de6166938064bf677f2f7c

SHA512
42a819a7ba8c9bddfa691558300e1208c00c0f49d1ffeb4bedd2aa2cad9d10d510f1dc6ef10dd83dc3c50655b641df8c6375c49e2f467ac447cd56a85e452b57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U1J1BPYJ\favicon[1].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5C44.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5C57.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/2956-25-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.