Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

1

0027e6574e...8.html

windows7-x64

1

0027e6574e...8.html

windows10-2004-x64

1

Analysis

  • max time kernel
    146s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/04/2024, 21:54 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0027e6574e7dcf879fd4e31455c0bb40_JaffaCakes118.html

  • Size

    201KB

  • MD5

    0027e6574e7dcf879fd4e31455c0bb40

  • SHA1

    7fd1485eb340fb09e1b3c03c530aa57ceaa2e534

  • SHA256

    351a4f5adc72933b4dfe555f79cc86068a2cd51a24eb297891d88fabf1088758

  • SHA512

    982e57216657b320e43c33e835751f67feaf6bb2d16ed8db6a16985d97321d26968f9afd7d125c920e1713cc04c9992853fb0d002068afbf27f378d3e83fac52

  • SSDEEP

    1536:kaGNYMHk6AO9mos1M/G4rlRiOpReFxe5FrKeXLPyOGvM:dG3u47

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0027e6574e7dcf879fd4e31455c0bb40_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2932
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2760

Network

  • flag-us
    DNS
    razgovorchik.ru
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    razgovorchik.ru
    IN A
    Response
    razgovorchik.ru
    IN A
    31.31.205.163
  • flag-us
    DNS
    masterhost.ru
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    masterhost.ru
    IN A
    Response
    masterhost.ru
    IN A
    90.156.132.125
  • flag-ru
    GET
    http://razgovorchik.ru/style_images/razgovorchik/menu/faq.gif
    IEXPLORE.EXE
    Remote address:
    31.31.205.163:80
    Request
    GET /style_images/razgovorchik/menu/faq.gif HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: razgovorchik.ru
    Connection: Keep-Alive
    Response
    HTTP/1.1 404 Not Found
    Content-Type: text/html
    Content-Length: 1468
    Date: Thu, 25 Apr 2024 21:54:33 GMT
    Server: lighttpd/1.4.45
  • flag-ru
    GET
    http://razgovorchik.ru/style_images/razgovorchik/menu/dn.gif
    IEXPLORE.EXE
    Remote address:
    31.31.205.163:80
    Request
    GET /style_images/razgovorchik/menu/dn.gif HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: razgovorchik.ru
    Connection: Keep-Alive
    Response
    HTTP/1.1 404 Not Found
    Content-Type: text/html
    Content-Length: 1468
    Date: Thu, 25 Apr 2024 21:54:33 GMT
    Server: lighttpd/1.4.45
  • flag-ru
    GET
    http://razgovorchik.ru/style_images/razgovorchik/menu/find.gif
    IEXPLORE.EXE
    Remote address:
    31.31.205.163:80
    Request
    GET /style_images/razgovorchik/menu/find.gif HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: razgovorchik.ru
    Connection: Keep-Alive
    Response
    HTTP/1.1 404 Not Found
    Content-Type: text/html
    Content-Length: 1468
    Date: Thu, 25 Apr 2024 21:54:33 GMT
    Server: lighttpd/1.4.45
  • flag-ru
    GET
    http://razgovorchik.ru/style_images/razgovorchik/menu/lb.gif
    IEXPLORE.EXE
    Remote address:
    31.31.205.163:80
    Request
    GET /style_images/razgovorchik/menu/lb.gif HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: razgovorchik.ru
    Connection: Keep-Alive
    Response
    HTTP/1.1 404 Not Found
    Content-Type: text/html
    Content-Length: 1468
    Date: Thu, 25 Apr 2024 21:54:33 GMT
    Server: lighttpd/1.4.45
  • flag-ru
    GET
    http://razgovorchik.ru/style_images/razgovorchik/menu/foto1.gif
    IEXPLORE.EXE
    Remote address:
    31.31.205.163:80
    Request
    GET /style_images/razgovorchik/menu/foto1.gif HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: razgovorchik.ru
    Connection: Keep-Alive
    Response
    HTTP/1.1 404 Not Found
    Content-Type: text/html
    Content-Length: 1468
    Date: Thu, 25 Apr 2024 21:54:33 GMT
    Server: lighttpd/1.4.45
  • flag-ru
    GET
    http://razgovorchik.ru/style_images/razgovorchik/menu/users.gif
    IEXPLORE.EXE
    Remote address:
    31.31.205.163:80
    Request
    GET /style_images/razgovorchik/menu/users.gif HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: razgovorchik.ru
    Connection: Keep-Alive
    Response
    HTTP/1.1 404 Not Found
    Content-Type: text/html
    Content-Length: 1468
    Date: Thu, 25 Apr 2024 21:54:33 GMT
    Server: lighttpd/1.4.45
  • flag-ru
    GET
    http://razgovorchik.ru/style_images/razgovorchik/menu/info.gif
    IEXPLORE.EXE
    Remote address:
    31.31.205.163:80
    Request
    GET /style_images/razgovorchik/menu/info.gif HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: razgovorchik.ru
    Connection: Keep-Alive
    Response
    HTTP/1.1 404 Not Found
    Content-Type: text/html
    Content-Length: 1468
    Date: Thu, 25 Apr 2024 21:54:33 GMT
    Server: lighttpd/1.4.45
  • flag-ru
    GET
    http://masterhost.ru/client/buttons/88x31/15.gif
    IEXPLORE.EXE
    Remote address:
    90.156.132.125:80
    Request
    GET /client/buttons/88x31/15.gif HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: masterhost.ru
    Connection: Keep-Alive
    Response
    HTTP/1.1 301 Moved Permanently
    Server: ddos-guard
    Date: Thu, 25 Apr 2024 21:54:33 GMT
    Connection: keep-alive
    Keep-Alive: timeout=60
    Location: https://masterhost.ru/client/buttons/88x31/15.gif
    Content-Type: text/html; charset=utf8
    Content-Length: 568
  • flag-us
    DNS
    ads.serveuser.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    ads.serveuser.com
    IN A
    Response
    ads.serveuser.com
    IN A
    41.212.227.208
  • flag-us
    DNS
    ads.serveuser.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    ads.serveuser.com
    IN A
  • flag-us
    DNS
    dd.cb.b0.a1.top.list.ru
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    dd.cb.b0.a1.top.list.ru
    IN A
    Response
    dd.cb.b0.a1.top.list.ru
    IN CNAME
    top-fwz1.mail.ru
    top-fwz1.mail.ru
    IN A
    95.163.52.67
  • flag-us
    DNS
    counter.yadro.ru
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    counter.yadro.ru
    IN A
    Response
    counter.yadro.ru
    IN A
    88.212.201.198
    counter.yadro.ru
    IN A
    88.212.202.52
    counter.yadro.ru
    IN A
    88.212.201.204
  • flag-ru
    GET
    http://counter.yadro.ru/hit?t14.1;r;s1280*720*24;ufile%3A//C%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C0027e6574e7dcf879fd4e31455c0bb40_JaffaCakes118.html;0.19267503877288244
    IEXPLORE.EXE
    Remote address:
    88.212.201.198:80
    Request
    GET /hit?t14.1;r;s1280*720*24;ufile%3A//C%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C0027e6574e7dcf879fd4e31455c0bb40_JaffaCakes118.html;0.19267503877288244 HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: counter.yadro.ru
    Connection: Keep-Alive
    Response
    HTTP/1.1 302 Moved Temporarily
    Date: Thu, 25 Apr 2024 21:54:34 GMT
    Server: 0W/0.8c
    Content-Type: text/html
    Location: https://counter.yadro.ru/hit?t14.1;r;s1280*720*24;ufile%3A//C%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C0027e6574e7dcf879fd4e31455c0bb40_JaffaCakes118.html;0.19267503877288244
    Content-Length: 32
    Expires: Wed, 26 Apr 2023 21:00:00 GMT
    Pragma: no-cache
    Cache-control: no-cache
  • flag-gb
    GET
    http://www.google-analytics.com/ga.js
    IEXPLORE.EXE
    Remote address:
    142.250.180.14:80
    Request
    GET /ga.js HTTP/1.1
    Accept: application/javascript, */*;q=0.8
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: www.google-analytics.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Strict-Transport-Security: max-age=10886400; includeSubDomains; preload
    X-Content-Type-Options: nosniff
    Content-Encoding: gzip
    Cross-Origin-Resource-Policy: cross-origin
    Server: Golfe2
    Content-Length: 17168
    Date: Thu, 25 Apr 2024 21:17:27 GMT
    Expires: Thu, 25 Apr 2024 23:17:27 GMT
    Cache-Control: public, max-age=7200
    Age: 2226
    Last-Modified: Tue, 12 Dec 2023 18:09:08 GMT
    Content-Type: text/javascript
    Vary: Accept-Encoding
  • flag-ru
    GET
    http://dd.cb.b0.a1.top.list.ru/counter?id=1097164;t=211;js=13;r=;j=true;s=1280*720;d=24;rand=0.6288132914412958
    IEXPLORE.EXE
    Remote address:
    95.163.52.67:80
    Request
    GET /counter?id=1097164;t=211;js=13;r=;j=true;s=1280*720;d=24;rand=0.6288132914412958 HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: dd.cb.b0.a1.top.list.ru
    Connection: Keep-Alive
    Response
    HTTP/1.1 302 Moved Temporarily
    Server: nginx
    Date: Thu, 25 Apr 2024 21:54:34 GMT
    Content-Length: 0
    Connection: keep-alive
    Keep-Alive: timeout=60
    Location: https://top-fwz1.mail.ru/counter?id=1097164;t=211;js=13;r=;j=true;s=1280*720;d=24;rand=0.6288132914412958;ver=30
    Access-Control-Allow-Origin: *
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Methods: GET, POST, HEAD, PUT, OPTIONS
    Access-Control-Allow-Headers: *
    AMP-Access-Control-Allow-Source-Origin: *
    Access-Control-Expose-Headers: AMP-Access-Control-Allow-Source-Origin
    Timing-Allow-Origin: *
    X-Content-Type-Options: nosniff
    P3P: CP="NOI DSP COR NID CUR PSA OUR NOR"
    Cache-Control: private, no-cache, no-store, max-age=0
    Pragma: no-cache
    Accept-CH: DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
    Accept-CH-Lifetime: 86400
  • flag-us
    DNS
    top-fwz1.mail.ru
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    top-fwz1.mail.ru
    IN A
    Response
    top-fwz1.mail.ru
    IN A
    95.163.52.67
  • flag-ru
    GET
    https://top-fwz1.mail.ru/counter?id=1097164;t=211;js=13;r=;j=true;s=1280*720;d=24;rand=0.6288132914412958;ver=30
    IEXPLORE.EXE
    Remote address:
    95.163.52.67:443
    Request
    GET /counter?id=1097164;t=211;js=13;r=;j=true;s=1280*720;d=24;rand=0.6288132914412958;ver=30 HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: top-fwz1.mail.ru
    Connection: Keep-Alive
    Response
    HTTP/1.1 302 Moved Temporarily
    Server: nginx
    Date: Thu, 25 Apr 2024 21:54:35 GMT
    Content-Length: 0
    Connection: keep-alive
    Keep-Alive: timeout=60
    Set-Cookie: FTID=2_PT4d13P1oO:1714082075:1097164:::; path=/; expires=Sat, 26-Apr-25 21:54:35 GMT; domain=.mail.ru; HttpOnly
    Location: https://top-fwz1.mail.ru/counter2?id=1097164;t=211;js=13;r=;j=true;s=1280*720;d=24;rand=0.6288132914412958;ver=30
    Access-Control-Allow-Origin: *
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Methods: GET, POST, HEAD, PUT, OPTIONS
    Access-Control-Allow-Headers: *
    AMP-Access-Control-Allow-Source-Origin: *
    Access-Control-Expose-Headers: AMP-Access-Control-Allow-Source-Origin
    Timing-Allow-Origin: *
    X-Content-Type-Options: nosniff
    P3P: CP="NOI DSP COR NID CUR PSA OUR NOR"
    Cache-Control: private, no-cache, no-store, max-age=0
    Pragma: no-cache
    Accept-CH: DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
    Accept-CH-Lifetime: 86400
  • flag-ru
    GET
    https://top-fwz1.mail.ru/counter2?id=1097164;t=211;js=13;r=;j=true;s=1280*720;d=24;rand=0.6288132914412958;ver=30
    IEXPLORE.EXE
    Remote address:
    95.163.52.67:443
    Request
    GET /counter2?id=1097164;t=211;js=13;r=;j=true;s=1280*720;d=24;rand=0.6288132914412958;ver=30 HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: top-fwz1.mail.ru
    Connection: Keep-Alive
    Cookie: FTID=2_PT4d13P1oO:1714082075:1097164:::
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Thu, 25 Apr 2024 21:54:35 GMT
    Content-Type: image/gif
    Content-Length: 912
    Connection: keep-alive
    Keep-Alive: timeout=60
    Set-Cookie: PVID=2BPTBu3yvN2O00001b3AnCYO:::0-0-0-b4529db-0-b4529db:CAASED4-OOF_JKOMMQ7Iez2Oh00aYK9k3tkulKNnJ16QE7c8V-mmM6GEP6yZT6LBy2kezCrI-Xbt7kUTIIaPkMcL36UgH1-VCnw9bMj2PTlr_uv2hjm0AHv4klq9Hlu7j0nLFsV67E5JhMsylyuzX0k4EFyDNg; path=/; expires=Sat, 26-Apr-25 21:54:35 GMT; HttpOnly; Secure; Partitioned
    Set-Cookie: VID=2BPTBu3yvN2O00001b3AnCYO:::0-0-0-b4529db-0-b4529db:CAASED4-OOF_JKOMMQ7Iez2Oh00aYK9k3tkulKNnJ16QE7c8V-mmM6GEP6yZT6LBy2kezCrI-Xbt7kUTIIaPkMcL36UgH1-VCnw9bMj2PTlr_uv2hjm0AHv4klq9Hlu7j0nLFsV67E5JhMsylyuzX0k4EFyDNg; path=/; expires=Sat, 26-Apr-25 21:54:35 GMT; domain=.mail.ru; HttpOnly
    Set-Cookie: FTID=0; path=/; expires=Thu, 01-Jan-70 00:00:01 GMT; domain=.mail.ru; HttpOnly
    Access-Control-Allow-Origin: *
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Methods: GET, POST, HEAD, PUT, OPTIONS
    Access-Control-Allow-Headers: *
    AMP-Access-Control-Allow-Source-Origin: *
    Access-Control-Expose-Headers: AMP-Access-Control-Allow-Source-Origin
    Timing-Allow-Origin: *
    X-Content-Type-Options: nosniff
    P3P: CP="NOI DSP COR NID CUR PSA OUR NOR"
    Cache-Control: private, no-cache, no-store, max-age=0
    Pragma: no-cache
    Accept-CH: DPR, Width, Viewport-Width, Downlink, Device-Memory, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version
    Accept-CH-Lifetime: 86400
  • flag-ru
    GET
    https://counter.yadro.ru/hit?t14.1;r;s1280*720*24;ufile%3A//C%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C0027e6574e7dcf879fd4e31455c0bb40_JaffaCakes118.html;0.19267503877288244
    IEXPLORE.EXE
    Remote address:
    88.212.201.198:443
    Request
    GET /hit?t14.1;r;s1280*720*24;ufile%3A//C%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C0027e6574e7dcf879fd4e31455c0bb40_JaffaCakes118.html;0.19267503877288244 HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: counter.yadro.ru
    Connection: Keep-Alive
    Response
    HTTP/1.1 302 Moved Temporarily
    Server: nginx/1.17.9
    Date: Thu, 25 Apr 2024 21:54:35 GMT
    Content-Type: text/html
    Content-Length: 32
    Connection: keep-alive
    Location: https://counter.yadro.ru/hit?q;t14.1;r;s1280*720*24;ufile%3A//C%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C0027e6574e7dcf879fd4e31455c0bb40_JaffaCakes118.html;0.19267503877288244
    Expires: Wed, 26 Apr 2023 21:00:00 GMT
    Pragma: no-cache
    Cache-control: no-cache
    P3P: policyref="/w3c/p3p.xml", CP="UNI"
    Set-Cookie: FTID=1cAj4R0Yxpen1cAj4R001BNH; path=/; expires=Fri, 25 Apr 2025 21:00:00 GMT; HttpOnly; Secure; SameSite=None; domain=.yadro.ru
    Strict-Transport-Security: max-age=86400
  • flag-ru
    GET
    https://counter.yadro.ru/hit?q;t14.1;r;s1280*720*24;ufile%3A//C%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C0027e6574e7dcf879fd4e31455c0bb40_JaffaCakes118.html;0.19267503877288244
    IEXPLORE.EXE
    Remote address:
    88.212.201.198:443
    Request
    GET /hit?q;t14.1;r;s1280*720*24;ufile%3A//C%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C0027e6574e7dcf879fd4e31455c0bb40_JaffaCakes118.html;0.19267503877288244 HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: counter.yadro.ru
    Connection: Keep-Alive
    Cookie: FTID=1cAj4R0Yxpen1cAj4R001BNH
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.17.9
    Date: Thu, 25 Apr 2024 21:54:36 GMT
    Content-Type: image/gif
    Content-Length: 185
    Connection: keep-alive
    Expires: Wed, 26 Apr 2023 21:00:00 GMT
    Pragma: no-cache
    Cache-control: no-cache
    P3P: policyref="/w3c/p3p.xml", CP="UNI"
    Set-Cookie: VID=3c9XfA2C-u8n1cAj4S001BNk; path=/; expires=Fri, 25 Apr 2025 21:00:00 GMT; HttpOnly; Secure; SameSite=None; domain=.yadro.ru
    Access-Control-Allow-Origin: *
    Strict-Transport-Security: max-age=86400
  • flag-us
    DNS
    www.microsoft.com
    iexplore.exe
    Remote address:
    8.8.8.8:53
    Request
    www.microsoft.com
    IN A
    Response
    www.microsoft.com
    IN CNAME
    www.microsoft.com-c-3.edgekey.net
    www.microsoft.com-c-3.edgekey.net
    IN CNAME
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    IN CNAME
    e13678.dscb.akamaiedge.net
    e13678.dscb.akamaiedge.net
    IN A
    23.55.97.181
  • flag-us
    DNS
    www.microsoft.com
    iexplore.exe
    Remote address:
    8.8.8.8:53
    Request
    www.microsoft.com
    IN A
    Response
    www.microsoft.com
    IN CNAME
    www.microsoft.com-c-3.edgekey.net
    www.microsoft.com-c-3.edgekey.net
    IN CNAME
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    IN CNAME
    e13678.dscb.akamaiedge.net
    e13678.dscb.akamaiedge.net
    IN A
    23.55.97.181
  • 31.31.205.163:80
    http://razgovorchik.ru/style_images/razgovorchik/menu/faq.gif
    http
    IEXPLORE.EXE
    853 B
     1.8kB
     12
    5

    HTTP Request

    GET http://razgovorchik.ru/style_images/razgovorchik/menu/faq.gif

    HTTP Response

    404
  • 31.31.205.163:80
    http://razgovorchik.ru/style_images/razgovorchik/menu/dn.gif
    http
    IEXPLORE.EXE
    852 B
     1.8kB
     12
    5

    HTTP Request

    GET http://razgovorchik.ru/style_images/razgovorchik/menu/dn.gif

    HTTP Response

    404
  • 31.31.205.163:80
    http://razgovorchik.ru/style_images/razgovorchik/menu/find.gif
    http
    IEXPLORE.EXE
    854 B
     1.8kB
     12
    5

    HTTP Request

    GET http://razgovorchik.ru/style_images/razgovorchik/menu/find.gif

    HTTP Response

    404
  • 31.31.205.163:80
    http://razgovorchik.ru/style_images/razgovorchik/menu/lb.gif
    http
    IEXPLORE.EXE
    904 B
     1.8kB
     13
    5

    HTTP Request

    GET http://razgovorchik.ru/style_images/razgovorchik/menu/lb.gif

    HTTP Response

    404
  • 31.31.205.163:80
    http://razgovorchik.ru/style_images/razgovorchik/menu/foto1.gif
    http
    IEXPLORE.EXE
    855 B
     1.8kB
     12
    5

    HTTP Request

    GET http://razgovorchik.ru/style_images/razgovorchik/menu/foto1.gif

    HTTP Response

    404
  • 31.31.205.163:80
    http://razgovorchik.ru/style_images/razgovorchik/menu/info.gif
    http
    IEXPLORE.EXE
    1.2kB
     3.5kB
     14
    7

    HTTP Request

    GET http://razgovorchik.ru/style_images/razgovorchik/menu/users.gif

    HTTP Response

    404

    HTTP Request

    GET http://razgovorchik.ru/style_images/razgovorchik/menu/info.gif

    HTTP Response

    404
  • 90.156.132.125:80
    masterhost.ru
    IEXPLORE.EXE
    518 B
     144 B
     11
    3
  • 90.156.132.125:80
    http://masterhost.ru/client/buttons/88x31/15.gif
    http
    IEXPLORE.EXE
    702 B
     1.1kB
     9
    6

    HTTP Request

    GET http://masterhost.ru/client/buttons/88x31/15.gif

    HTTP Response

    301
  • 90.156.132.125:443
    masterhost.ru
    tls
    IEXPLORE.EXE
    830 B
     4.6kB
     11
    13
  • 88.212.201.198:80
    counter.yadro.ru
    IEXPLORE.EXE
    518 B
     144 B
     11
    3
  • 88.212.201.198:80
    http://counter.yadro.ru/hit?t14.1;r;s1280*720*24;ufile%3A//C%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C0027e6574e7dcf879fd4e31455c0bb40_JaffaCakes118.html;0.19267503877288244
    http
    IEXPLORE.EXE
    1.7kB
     571 B
     11
    3

    HTTP Request

    GET http://counter.yadro.ru/hit?t14.1;r;s1280*720*24;ufile%3A//C%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C0027e6574e7dcf879fd4e31455c0bb40_JaffaCakes118.html;0.19267503877288244

    HTTP Response

    302
  • 142.250.180.14:80
    http://www.google-analytics.com/ga.js
    http
    IEXPLORE.EXE
    858 B
     18.3kB
     13
    16

    HTTP Request

    GET http://www.google-analytics.com/ga.js

    HTTP Response

    200
  • 142.250.180.14:80
    www.google-analytics.com
    IEXPLORE.EXE
    190 B
     92 B
     4
    2
  • 95.163.52.67:80
    http://dd.cb.b0.a1.top.list.ru/counter?id=1097164;t=211;js=13;r=;j=true;s=1280*720;d=24;rand=0.6288132914412958
    http
    IEXPLORE.EXE
    627 B
     1.2kB
     6
    5

    HTTP Request

    GET http://dd.cb.b0.a1.top.list.ru/counter?id=1097164;t=211;js=13;r=;j=true;s=1280*720;d=24;rand=0.6288132914412958

    HTTP Response

    302
  • 95.163.52.67:80
    dd.cb.b0.a1.top.list.ru
    IEXPLORE.EXE
    190 B
     132 B
     4
    3
  • 95.163.52.67:443
    https://top-fwz1.mail.ru/counter2?id=1097164;t=211;js=13;r=;j=true;s=1280*720;d=24;rand=0.6288132914412958;ver=30
    tls, http
    IEXPLORE.EXE
    1.9kB
     8.6kB
     14
    14

    HTTP Request

    GET https://top-fwz1.mail.ru/counter?id=1097164;t=211;js=13;r=;j=true;s=1280*720;d=24;rand=0.6288132914412958;ver=30

    HTTP Response

    302

    HTTP Request

    GET https://top-fwz1.mail.ru/counter2?id=1097164;t=211;js=13;r=;j=true;s=1280*720;d=24;rand=0.6288132914412958;ver=30

    HTTP Response

    200
  • 95.163.52.67:443
    top-fwz1.mail.ru
    tls
    IEXPLORE.EXE
    747 B
     4.9kB
     10
    11
  • 90.156.132.125:443
    masterhost.ru
    tls
    IEXPLORE.EXE
    793 B
     389 B
     7
    5
  • 41.212.227.208:80
    ads.serveuser.com
    IEXPLORE.EXE
    152 B
     3
  • 41.212.227.208:80
    ads.serveuser.com
    IEXPLORE.EXE
    152 B
     3
  • 88.212.201.198:443
    https://counter.yadro.ru/hit?q;t14.1;r;s1280*720*24;ufile%3A//C%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C0027e6574e7dcf879fd4e31455c0bb40_JaffaCakes118.html;0.19267503877288244
    tls, http
    IEXPLORE.EXE
    1.9kB
     4.7kB
     12
    9

    HTTP Request

    GET https://counter.yadro.ru/hit?t14.1;r;s1280*720*24;ufile%3A//C%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C0027e6574e7dcf879fd4e31455c0bb40_JaffaCakes118.html;0.19267503877288244

    HTTP Response

    302

    HTTP Request

    GET https://counter.yadro.ru/hit?q;t14.1;r;s1280*720*24;ufile%3A//C%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CTemp%5C0027e6574e7dcf879fd4e31455c0bb40_JaffaCakes118.html;0.19267503877288244

    HTTP Response

    200
  • 41.212.227.208:80
    ads.serveuser.com
    IEXPLORE.EXE
    152 B
     3
  • 41.212.227.208:80
    ads.serveuser.com
    IEXPLORE.EXE
    152 B
     3
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    960 B
     7.6kB
     10
    12
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    1.2kB
     7.7kB
     12
    13
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    779 B
     7.6kB
     9
    12
  • 8.8.8.8:53
    razgovorchik.ru
    dns
    IEXPLORE.EXE
    61 B
     77 B
     1
    1

    DNS Request

    razgovorchik.ru

    DNS Response

    31.31.205.163

  • 8.8.8.8:53
    masterhost.ru
    dns
    IEXPLORE.EXE
    59 B
     75 B
     1
    1

    DNS Request

    masterhost.ru

    DNS Response

    90.156.132.125

  • 8.8.8.8:53
    ads.serveuser.com
    dns
    IEXPLORE.EXE
    126 B
     79 B
     2
    1

    DNS Request

    ads.serveuser.com

    DNS Request

    ads.serveuser.com

    DNS Response

    41.212.227.208

  • 8.8.8.8:53
    dd.cb.b0.a1.top.list.ru
    dns
    IEXPLORE.EXE
    69 B
     113 B
     1
    1

    DNS Request

    dd.cb.b0.a1.top.list.ru

    DNS Response

    95.163.52.67

  • 8.8.8.8:53
    counter.yadro.ru
    dns
    IEXPLORE.EXE
    62 B
     110 B
     1
    1

    DNS Request

    counter.yadro.ru

    DNS Response

    88.212.201.198
    88.212.202.52
    88.212.201.204

  • 8.8.8.8:53
    top-fwz1.mail.ru
    dns
    IEXPLORE.EXE
    62 B
     78 B
     1
    1

    DNS Request

    top-fwz1.mail.ru

    DNS Response

    95.163.52.67

  • 8.8.8.8:53
    www.microsoft.com
    dns
    iexplore.exe
    63 B
     230 B
     1
    1

    DNS Request

    www.microsoft.com

    DNS Response

    23.55.97.181

  • 8.8.8.8:53
    www.microsoft.com
    dns
    iexplore.exe
    63 B
     230 B
     1
    1

    DNS Request

    www.microsoft.com

    DNS Response

    23.55.97.181

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
    Filesize

    252B

    MD5

    26c7bc76a8ad62fc496f88bf34fc9698

    SHA1

    6c3fd613036210c3dac8b0e61cc1347b90594a54

    SHA256

    fe5aa234e906a04a59dc52ce14631df7f5b76206d9b7f404b0c42680bd116b6b

    SHA512

    1dbf2314d1a985bdcfcb7c91cf890be4b93121b31a85db1a776734de1ef2ba01e3b93e512d8f4379e6a3d70c986c599f2aebce1035b5f0d9e451726763179e84

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    48f2d9c41643da8ca606ca7eec1614e3

    SHA1

    f0bdea25160705c9d5173c7094a7d0278098af19

    SHA256

    3f44f234ca06ce3ea2aeacd45b326669615111183363384e429a5c29439d5f82

    SHA512

    00e00ce82fcfb4099b3d5e2a369c4e201729d7b6c1b6e5c680575b32eec0016e669015befee0e16069d525794a1ffc5b94717607d6a97057c49ba302f0ae7d8a

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    f2d9ebc321d6596cc07e6e963999ba53

    SHA1

    d61f4bffa8882c7f51513111d07e78b33d9e48b7

    SHA256

    3470c91747fb86fa4f51b7c94bdfe6fa453f8d073b9548d0198f9dff1be55faf

    SHA512

    3f3bd77be1b50e47f399fdefac58a474d869cb6df4d0d5254321ebf0e5d9d82ecd249a8c3a8462efe3d053a932a923c21aeaaf1f2a4b1c57633c9c80eed23163

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    a671ea9e68a0265a810653050fd1c4af

    SHA1

    736686969803caefe414c025c70cc2ac785f4a66

    SHA256

    902689f9e558a07486ac185b1f4df60c103891c27e2dcc951da9b3fa9e933c88

    SHA512

    1d867c73557dbe3fe5656dcf44b7b7efc8a81fb33422fff56186efea1228b9f499bbcc0a893b8946369190670a8d95e58acfb90009dd9586bd08ef5ea02fd84a

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    229cd5d3bc88430729e442b6dc2a8867

    SHA1

    7e020d4289e8cf69d1ad0346e310d6317fbfecdb

    SHA256

    efff83fdf6155464166a7cf8abd0f6065fdd6ef7640bac9851d20937b5675c38

    SHA512

    11540ad14bdb402d57f1742ab3a77065a2c1cd67676d89179954344dc23ccf1d6cdf9d0b6d7db22a0da407ed3d4de897506a8a1960d2c6df379e3191d484a926

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    e6c6592e9cf8461516e2ea2d1aa2421f

    SHA1

    e6197fe1a43ca835203f4a5a2b5dca38c79a320b

    SHA256

    7afad8fcd6c182691cd9e5d98963adeb6de8bbf07a5a8245684e33b49bc866ae

    SHA512

    9d43e11fe983f515b9b6117e933752308abd04481696218345c850983006ea9491680c58de524872cc2bdcc269d62f97f4599e9f1c3adba042052220fac97094

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    242B

    MD5

    69c23f5f7f7f8b32b7202577b11136eb

    SHA1

    d17c05b05046f6d314f83b8464b339ec5c3a2a45

    SHA256

    49b9e335bfa16d2c3cba4a116f4f818f1962582bea0ac50ef7ebaf1d4266242e

    SHA512

    07e85905660e7632b4ea0eff1d49e8bee68cdd497beb5740e8f497cdac9f6e74a1dd38fc81f0bd1c9f1ceb5384d01646d2b2470b67d7a9f4ad38d6b993dc9d65

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    242B

    MD5

    f8e93a81dce2641aa1ab732e88bd2603

    SHA1

    43df8fee5a55d157f9118595b426a09d8f450ab0

    SHA256

    bebb6090847ca2a633989c19c0514258be51584ac9fe0a3440cc236f031755cb

    SHA512

    8c0c9fd906526b4a9995e5f2208a934c684dd9fddcd170c814a2de3abfbc7c52a4cc3e04b21162b2000c2fd64aafff559e009d2010673eb897325740def3a757

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar12BD.tmp
    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.