190eb173abd20b91c1f801c2797b4c7d66e8d8441388ee7a67fda23ef74cfea1

Analysis

max time kernel
139s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 21:16 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bbde04692df4a0a1be405f8a7ae98e0_JaffaCakes118.html
Size

18KB
MD5

2bbde04692df4a0a1be405f8a7ae98e0
SHA1

c219f6bb21a2ebae4ac84b8db10d2f4f720b7c28
SHA256

190eb173abd20b91c1f801c2797b4c7d66e8d8441388ee7a67fda23ef74cfea1
SHA512

157bcfe9597e48a3bcf63fd5fc768825d90d8c20e2dff4496225ac40a89146a3505cf78d6092726bf0d6306aa34f61d8f8ac2a684a9d5a7e088e3ce4a590f78e
SSDEEP

384:SIIWx1BMYBMgBM+BM3BMnBMLBM9GH0HN/Am+tbLbpXj2eXt5Qo6i:Syx1CYCgC+C3CnCLCkHGN/sXj2eXtAi

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000353f8663ffb5e18dd9a8b073e36285af82c73e2f625332a1b812733ddee61cb5000000000e8000000002000020000000278fe9d4e1335060e3f2dbbe19b67bf44b080fce2cebd90053a858957923d62e900000008f431c5bea00d8c4b2885d7d84876f89633599b03f5fa8ba0e9c83c674698081c3cfac015298ee95829126f826605e5232ab707b1f72adf3caf3fa9a412c6c261b0a755049f36fe3e1cc5e67b5e83292ada484f2797368c28ae20aa8f575ebf7633b757f23d228fff2ea607b9879a817d64c3b09b4169a50f347977c97d296f97d6e4c72b149b97db0ccef1793fe418540000000a8d7a2a57fd127289813a7ed3196c597682ce9b424ea012f6d46fc82547a37a5abc4956d18df0e8f8b5175cc2e31d9cbf3d2b106c64bb7d5c4518dff1d243efb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e05eef5156a2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000b76acd00dab88aa69249df7528d9398d7618b2e2ab0d5f30241535307b98abaf000000000e800000000200002000000072b396dfc297b2d113201166883ddb08bab8bdaa45faa5878c145393f3b3637b20000000b969eff26b775d0b2439c0ced55a8b74519490b02d3eacf392c8904d592a642640000000cdfff3297d27471605d3e1ae848b2b3ba2d82a240399bfe734eb303c0d12515a52b1afe9f77a054c390cda1c8e6aabf25e36e8e1f471351a6009e62badd4a2f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{76E056F1-0E49-11EF-B35F-5267BFD3BAD1} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421451285"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
604	IEXPLORE.EXE
604	IEXPLORE.EXE
604	IEXPLORE.EXE
604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 604	2180	iexplore.exe	28
PID 2180 wrote to memory of 604	2180	iexplore.exe	28
PID 2180 wrote to memory of 604	2180	iexplore.exe	28
PID 2180 wrote to memory of 604	2180	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2bbde04692df4a0a1be405f8a7ae98e0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:604

Network

DNS

blanko.com.ba

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

blanko.com.ba

IN A

Response
DNS

www.europrinty.net

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.europrinty.net

IN A

Response

www.europrinty.net

IN A

172.67.218.248

www.europrinty.net

IN A

104.21.24.139
GET

http://www.europrinty.net/js/jquery.min.php?key=b64&utm_campaign=snt2014&utm_source=&utm_medium=&utm_content=file:///C:/Users/Admin/AppData/Local/Temp/2bbde04692df4a0a1be405f8a7ae98e0_JaffaCakes118.html&utm_term=About%20Joomla!%2C%20General%2C%20Extensions&se_referrer=

IEXPLORE.EXE

Remote address:

172.67.218.248:80

Request

GET /js/jquery.min.php?key=b64&utm_campaign=snt2014&utm_source=&utm_medium=&utm_content=file:///C:/Users/Admin/AppData/Local/Temp/2bbde04692df4a0a1be405f8a7ae98e0_JaffaCakes118.html&utm_term=About%20Joomla!%2C%20General%2C%20Extensions&se_referrer= HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.europrinty.net
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Thu, 09 May 2024 21:17:06 GMT
Content-Type: text/html
Content-Length: 167
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Thu, 09 May 2024 22:17:06 GMT
Location: https://www.europrinty.net/js/jquery.min.php?key=b64&utm_campaign=snt2014&utm_source=&utm_medium=&utm_content=file:///C:/Users/Admin/AppData/Local/Temp/2bbde04692df4a0a1be405f8a7ae98e0_JaffaCakes118.html&utm_term=About%20Joomla!%2C%20General%2C%20Extensions&se_referrer=
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ChjexJ3SZkHmIXg%2Bzpj7oD7u3s9xFFJtImn4%2BFy%2Bb25vYGH9KAxhtjJfcj3QQBaLUzluYqefAW23e9kDRs081TxoeSByXI%2FthG0sbltDK648IcErTve5KHYERLzoT80Ln0TLNKk%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 8814b6e65821385e-LHR
alt-svc: h3=":443"; ma=86400
GET

https://www.europrinty.net/js/jquery.min.php?key=b64&utm_campaign=snt2014&utm_source=&utm_medium=&utm_content=file:///C:/Users/Admin/AppData/Local/Temp/2bbde04692df4a0a1be405f8a7ae98e0_JaffaCakes118.html&utm_term=About%20Joomla!%2C%20General%2C%20Extensions&se_referrer=

IEXPLORE.EXE

Remote address:

172.67.218.248:443

Request

GET /js/jquery.min.php?key=b64&utm_campaign=snt2014&utm_source=&utm_medium=&utm_content=file:///C:/Users/Admin/AppData/Local/Temp/2bbde04692df4a0a1be405f8a7ae98e0_JaffaCakes118.html&utm_term=About%20Joomla!%2C%20General%2C%20Extensions&se_referrer= HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.europrinty.net
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Date: Thu, 09 May 2024 21:17:08 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Security-Policy: frame-ancestors 'self';
Set-Cookie: sid_customer_s_71245=ba939741565cc9c72a67e0ab5b1daf8b-1-C; expires=Thu, 23-May-2024 21:17:08 GMT; Max-Age=1209600; path=/; domain=.europrinty.net; secure; HttpOnly; SameSite=lax
Location: https://europrinty.net/js/jquery.min.php?key=b64&utm_campaign=snt2014&utm_source=&utm_medium=&utm_content=file%3A%2F%2F%2FC%3A%2FUsers%2FAdmin%2FAppData%2FLocal%2FTemp%2F2bbde04692df4a0a1be405f8a7ae98e0_JaffaCakes118.html&utm_term=About+Joomla%21%2C+General%2C+Extensions&se_referrer=
Vary: Accept-Encoding
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D%2Be%2FQLV7jzHJdc%2B25DTgavVdTIOwXCDBKSoTf9tMAzsMEEcWYTc%2Fnvf0kMSxCRHPL0J9XHZlHuHHau5ypGcZrhDzfNeGqFahhF3saC3Mst1N2T5QxF0SY3iCCMz9mfePAfxN%2Frw%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8814b6eb3836459c-LHR
alt-svc: h3=":443"; ma=86400
DNS

europrinty.net

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

europrinty.net

IN A

Response

europrinty.net

IN A

104.21.24.139

europrinty.net

IN A

172.67.218.248
GET

https://europrinty.net/js/jquery.min.php?key=b64&utm_campaign=snt2014&utm_source=&utm_medium=&utm_content=file%3A%2F%2F%2FC%3A%2FUsers%2FAdmin%2FAppData%2FLocal%2FTemp%2F2bbde04692df4a0a1be405f8a7ae98e0_JaffaCakes118.html&utm_term=About+Joomla%21%2C+General%2C+Extensions&se_referrer=

IEXPLORE.EXE

Remote address:

104.21.24.139:443

Request

GET /js/jquery.min.php?key=b64&utm_campaign=snt2014&utm_source=&utm_medium=&utm_content=file%3A%2F%2F%2FC%3A%2FUsers%2FAdmin%2FAppData%2FLocal%2FTemp%2F2bbde04692df4a0a1be405f8a7ae98e0_JaffaCakes118.html&utm_term=About+Joomla%21%2C+General%2C+Extensions&se_referrer= HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: europrinty.net
Connection: Keep-Alive
Cookie: sid_customer_s_71245=ba939741565cc9c72a67e0ab5b1daf8b-1-C

Response

HTTP/1.1 404 Not Found

Date: Thu, 09 May 2024 21:17:10 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Security-Policy: frame-ancestors 'self';
Set-Cookie: sid_customer_s_71245=ba939741565cc9c72a67e0ab5b1daf8b-1-C; expires=Thu, 23-May-2024 21:17:09 GMT; Max-Age=1209600; path=/; domain=.europrinty.net; secure; HttpOnly; SameSite=lax
Set-Cookie: ab__device=desktop; expires=Thu, 09-May-2024 22:17:09 GMT; Max-Age=3600
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fw3rhfIIcNDJmZVNs0rZWWKdDfa8HoVcj8hHjCzXn3mt6wBC21C0EwtqBmcvY28DV%2FMk0%2BxgD%2BuBSL4yZvY%2BV92C4PzYUpkkjpSDVf3WiXsvLJ%2BvErnuM0bKGZXadLW5Dg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8814b6f24a26950e-LHR
Content-Encoding: gzip
alt-svc: h3=":443"; ma=86400
DNS

www.microsoft.com

iexplore.exe

Remote address:

8.8.8.8:53

Request

www.microsoft.com

IN A

Response

www.microsoft.com

IN CNAME

www.microsoft.com-c-3.edgekey.net

www.microsoft.com-c-3.edgekey.net

IN CNAME

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

IN CNAME

e13678.dscb.akamaiedge.net

e13678.dscb.akamaiedge.net

IN A

2.21.17.194
DNS

www.microsoft.com

iexplore.exe

Remote address:

8.8.8.8:53

Request

www.microsoft.com

IN A

Response

www.microsoft.com

IN CNAME

www.microsoft.com-c-3.edgekey.net

www.microsoft.com-c-3.edgekey.net

IN CNAME

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

IN CNAME

e13678.dscb.akamaiedge.net

e13678.dscb.akamaiedge.net

IN A

2.21.17.194

172.67.218.248:80

http://www.europrinty.net/js/jquery.min.php?key=b64&utm_campaign=snt2014&utm_source=&utm_medium=&utm_content=file:///C:/Users/Admin/AppData/Local/Temp/2bbde04692df4a0a1be405f8a7ae98e0_JaffaCakes118.html&utm_term=About%20Joomla!%2C%20General%2C%20Extensions&se_referrer=

http

IEXPLORE.EXE

774 B
2.4kB
6
5

HTTP Request

GET http://www.europrinty.net/js/jquery.min.php?key=b64&utm_campaign=snt2014&utm_source=&utm_medium=&utm_content=file:///C:/Users/Admin/AppData/Local/Temp/2bbde04692df4a0a1be405f8a7ae98e0_JaffaCakes118.html&utm_term=About%20Joomla!%2C%20General%2C%20Extensions&se_referrer=

HTTP Response

301
172.67.218.248:80

www.europrinty.net

IEXPLORE.EXE

466 B
92 B
10
2
172.67.218.248:443

https://www.europrinty.net/js/jquery.min.php?key=b64&utm_campaign=snt2014&utm_source=&utm_medium=&utm_content=file:///C:/Users/Admin/AppData/Local/Temp/2bbde04692df4a0a1be405f8a7ae98e0_JaffaCakes118.html&utm_term=About%20Joomla!%2C%20General%2C%20Extensions&se_referrer=

tls, http

IEXPLORE.EXE

1.4kB
8.5kB
11
12

HTTP Request

GET https://www.europrinty.net/js/jquery.min.php?key=b64&utm_campaign=snt2014&utm_source=&utm_medium=&utm_content=file:///C:/Users/Admin/AppData/Local/Temp/2bbde04692df4a0a1be405f8a7ae98e0_JaffaCakes118.html&utm_term=About%20Joomla!%2C%20General%2C%20Extensions&se_referrer=

HTTP Response

301
104.21.24.139:443

https://europrinty.net/js/jquery.min.php?key=b64&utm_campaign=snt2014&utm_source=&utm_medium=&utm_content=file%3A%2F%2F%2FC%3A%2FUsers%2FAdmin%2FAppData%2FLocal%2FTemp%2F2bbde04692df4a0a1be405f8a7ae98e0_JaffaCakes118.html&utm_term=About+Joomla%21%2C+General%2C+Extensions&se_referrer=

tls, http

IEXPLORE.EXE

1.8kB
27.8kB
19
29

HTTP Request

GET https://europrinty.net/js/jquery.min.php?key=b64&utm_campaign=snt2014&utm_source=&utm_medium=&utm_content=file%3A%2F%2F%2FC%3A%2FUsers%2FAdmin%2FAppData%2FLocal%2FTemp%2F2bbde04692df4a0a1be405f8a7ae98e0_JaffaCakes118.html&utm_term=About+Joomla%21%2C+General%2C+Extensions&se_referrer=

HTTP Response

404
104.21.24.139:443

europrinty.net

tls

IEXPLORE.EXE

821 B
5.8kB
11
10
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

747 B
7.6kB
9
11
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

747 B
7.6kB
9
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

781 B
7.7kB
9
12

8.8.8.8:53

blanko.com.ba

dns

IEXPLORE.EXE

59 B
119 B
1
1

DNS Request

blanko.com.ba
8.8.8.8:53

www.europrinty.net

dns

IEXPLORE.EXE

64 B
96 B
1
1

DNS Request

www.europrinty.net

DNS Response

172.67.218.248

104.21.24.139
8.8.8.8:53

europrinty.net

dns

IEXPLORE.EXE

60 B
92 B
1
1

DNS Request

europrinty.net

DNS Response

104.21.24.139

172.67.218.248
8.8.8.8:53

www.microsoft.com

dns

iexplore.exe

63 B
230 B
1
1

DNS Request

www.microsoft.com

DNS Response

2.21.17.194
8.8.8.8:53

www.microsoft.com

dns

iexplore.exe

63 B
230 B
1
1

DNS Request

www.microsoft.com

DNS Response

2.21.17.194

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
9a3c34e03846ccde8d32d443534c4306

SHA1
3f5f05d29820f28016facc33a93a51e6d96b8e20

SHA256
56a06dd71867ee4a8879ddf82748a4bff2b56141e2103324588b4a3ce74521db

SHA512
91b33182b0cde22bea9fbf00173cb4ca7d41f5f3b4e13dc782308b24de34bd0ed8a4a69fd392742bf3b2e92e2d3cc9ae0f7600dbbcbaeb86acbf5d7db612dded

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02e7ae09d9b9123eac47f02d405a299d

SHA1
08d990d8cd5b9742403ba378f8d4510ca045a422

SHA256
9a3a4e6872400cdf65bda487eb004ce21159aaf916a6a08e0b973b517cbd54de

SHA512
950cc0436238d1dcc81961c0b600f7a941bba57bd607b63225d2bc934e354f6c7e0166b6af0f4be175e15a9dfc0ddc85961422a79128748426d13dc740eb6c6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5173c1847879469c86aff604df9aa4c0

SHA1
5dd22ffce788feb1e199be17c8b6a517179ff21f

SHA256
c10da66959ddc3610bb31f1ccfedcab70ed5f4f4a20a64a266d33c28f44e3a62

SHA512
d6edb6494f83b32dd9e5217f8c070c125b884d5a4ccb588ca946ab3c7868523b005a62d60f97da3d9358a0f9af00c4e740e8c2c0db970dd64f041ec8e072d10a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffd22c6b80ad265a86e743c09a7a14c8

SHA1
deff5a8087118517f9987c48a198c099dd50f1f8

SHA256
2b4937f89f77b6c0473895f70144787a4bd657ca214d1aac38c3db05a7629369

SHA512
1250b7e47e76dc795c033ba8b34d40d63254ab33002306df63be121c64c67f49ef5b4a09e0cf80e3ba10577d67d2a191e5f641f977548c11132864380e5a1c0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f0f9c7548e2f293886f5c20c5b66b8ba

SHA1
1a81d079eb6c57b4264f7cd256531bc57c0f4ddc

SHA256
f487c15e9a999755f946b37f20dc5e91f83463103246656b0db99ee57b89c0b8

SHA512
14a717749120913c7f568bc66d541e1a6ff6954b51b25b55d34a327d1c070069ec21b59c565a8dc9664bce6429b8aba6ad0af9bed2edf88452c15de0571e6589

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a36473396011ace9780d3e2dac141dcb

SHA1
6db8b945ff037b0f376db034b8037b4dbd775e43

SHA256
02d3573ee25e0de43414ab1c95044a5de1fc4af6cfdba7d3efa5b81a2ed1c138

SHA512
2e2894c76a31c398bac51abf72e4404e49b936e9ae80f406275bf25a84c5d0015209755667ebb7fafbace850da6014a3004812cbf41aa829e80a32fe4bfd2326

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
663646280dc1e633fae64a196ebcf516

SHA1
c02b317a641781adf397d163472b2aea5d2e6b3a

SHA256
7fa8abc9f00700888357f9ca5ffcd33d3d2386d48993b0ccdd95a3b2a34ddcd0

SHA512
a58b7e3a1ec7479828dfecdce2f01d2df02a64ae99f89b5b25cfcbfe19e6c6f5d9ec17d369f664bc5d653d9a9aeac6a8415f5a7bb130d72e943b7fb096324cf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef67a23b6431ccb9bd7eae4803e2e2ac

SHA1
5d222ec9b56db3a1d0190d54d46c60915b8ff0e4

SHA256
96ef7d57aa20143c173f316e30a9f29bbdc22a7588040bd3241c60f96a93d823

SHA512
9017e246221b6ceecbfa3d53010569c5e7ee95d3e57178cf0123c56c41df298bd2b6585618976a94cb78b958aed8e6ed6c6c749f3dc3ef07b052e0320ca062ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eaefff3e0da0f429ba2970d7a071bc62

SHA1
e2c043bbdc3d6e2f374ac01ef81768630d873f46

SHA256
c2c28348aa4cd60e65ae67e814c8c32233cd7ed0d3e20a35736c21005589c1c2

SHA512
64b12f92d717834d610e99e7452dc194b3abfa55f12dc424c77098f6ecf1958c045593d1c6a5bd8a69ec0345a0134c9ae22167a9366afb5c1de2c845fa620dd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
22bbaccb9a64aee68d2a102c735c148c

SHA1
d0d10635f3969475611051a00b0e8c990cfca0dc

SHA256
014a262570391ea5687c29c71b276d24d5bcf0ddcbe18665d43100ba29cdc849

SHA512
67a4c638c9e80348072628429b162eab4a9c458847886efe75a88ea186cbf62ba96133ef4f90c7e78c11fcf5061b0e8ffe42ac4d5e7c32603c065a649ed5aa59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b72fb2c541e0b990ded9a8d666ca0de3

SHA1
18b13522584afe42012fe063b1dc8371b73b363a

SHA256
0f36d9f9a2c50f8772b101aa1f7674b7aaf7fb193d363ad7c0ee7dd11c26ddbe

SHA512
991658d870536daf0934852081b7e9b18b502b401193dddebe071532b5c761673b5b395560a2abb0961b56b74db4d824ba699b0f4fc23ee64b75e9599956ab60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f58050e5461d3ca029b71cc5365da0b5

SHA1
a3bd079e2b73328f8cda8a83acb979b5c2498443

SHA256
9cec7bd06b01ea2e413ab8c9c9755a6716d846fb7bb33366cec7bb2fa109f6ef

SHA512
c094f3fbdbe811df04fc1607b755c4ae9477fbda5d32660adfc84b2311082497240dcd2ff0ef1b5e8363ba31aad64a78d0b3db1ca73d7ee6df5d60ed61295b6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
28943db7e25554958f146d6dd86ace12

SHA1
5a90b0668ae75701c24290258b83f80513d76fc0

SHA256
4b33755d94d7773edef23638f94eefc13342f7cec831f764b4904ba72a381abb

SHA512
cff4f5e8d3db0abf52ddd162e1b2f6e0b54691ce478a9e932a4b93a8a273a690d83ae612f60594d13201cc12177ffde34829bd8b8f477605951cf974b35ba44b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a2b78e59a67d87e7db9650f1a3a81027

SHA1
24d22affda6bdbb44be8af625d5af7927eae53b2

SHA256
ca8402f83eb6c320e9046a01ae99d28b2f2a0387ebe22bcf0a8d7a4fea0215d5

SHA512
6936adbc2865ae17158b3022d678831fcad037b162711f1034ee662b530a7a2913dbad47d99ae23380c4266a2fd3e475bbb5750b350bbfee5e667b33c0e52989

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d975a3e97e3f79ce1dd96fbd7c655d7c

SHA1
efc4c1b46e2390dbccbad1568039033d03fca233

SHA256
a4bfb84d0b1056bd13f2ad142491bb489c4013f537ae65d2aa8ce9a7365388bd

SHA512
5fad3f153108ed6532c3ef620aab509d258e1cfece435b8c2cbe25007878c47c385d5c944493638d45959d6ee52f0b6a220a051249e12409e6bd5866b7593bc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
091a42c8748bb333282e6cbb71e43e9e

SHA1
847414bbb13fb0fb2ea2105e8a0ae8d2f742c46d

SHA256
12a443d8ff58e765fc59f11f1176257620c539f419b0541e4f1c7d7dad00ce23

SHA512
b051724cc30efcb7ff2dc844e155225a78c1f547d6392c460562e1c329c6098ecf500e92f3304bada7333248b4a9ca82edfbf110a04c09f98e6a02fd86ae52ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1e68e508ab133109a5d1a1aff3cfc45

SHA1
518d1baa30f7b3662c52b034096583abbe7ae6fd

SHA256
7b8149423bf006e6af5840d2ad0fd4c4fdfaf94a9ccd7678eead944a0aa73b0e

SHA512
94002b84c758cd3a80baba84e0e10fee73ff87f2547c746c587376898f743ce9d290400d5a784bd61c8d982d94c357427918da29095fa7dff9eb9b43a285a34d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a57198af086d394331dcdec91d96e9b5

SHA1
91d54232ab958fac555ba0b9990f07581f5c7a74

SHA256
45c044fd4c05368e02ea6caccb393cd096db8ace5bcb9e2e0a89a3a723101a0e

SHA512
6bf7f567a66ec6ac810a3daace1856ec75a828c28532a6360277ab4ce1d94e4bb157c49a4ca347578ac5f521f0968576c7f641f57405e7a1e07a77fd8c9ebb1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e9ec3531453022894b06aa7fd04e8a59

SHA1
3787fde4a6a57f2587b197383ee8a29948106864

SHA256
5162aaf3510ea1e637ca683ffc6c4635e565e5afec30927593e3da74ad4821ff

SHA512
4b9b4abb5848dd26e2f1035178ccfc505af3e44d06bb42f9a7907122463551f3dff672456e79c4abcd70c50c1c2288ce5591c41fa48840f949b65a4296b95b1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
34f65d367c152a700a44b74392c80c8e

SHA1
9046ebfe11cac42b6d603ad52a32aa1863dc277e

SHA256
374e62486aaedad609e34fcb9b4638125ea1c1cc82dabb349c7f5ff8624f7644

SHA512
6e68526af717c7da12fd93aa23a9c55ee7257e714b4d30560d1c1681a3de9508af07072e3b79a351ab7d9e3dc2f972438acf0244138a6759822d61ad1a456f94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
908623d360ffaad765206171b9021bab

SHA1
e90f1b76e90ec1543a2e9e2acf9ebdad6a1556c9

SHA256
4ffd3a0746df2667ec80c7756d677757f6e9e5084ecaae5a2e95c1fa5c37744b

SHA512
beadb516e8ab9d711c65d95e1a736449ce859e0fac9bf2b4749abb5056635b8338c2d0d42977e2cf90fc90b8efb3eae7079d361ed1ac6173440d23ef5893f524

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
fa774808b4affbd682dcd8aa0d1ca45e

SHA1
b0e89a1a71cfa9129641c791c0a61cc5304c3a99

SHA256
1f23f3f1374e853cea899f4739d4f5d5c92f0e9d2029e8030027c073bf81e95f

SHA512
9c9c15977b43bd57a6d7d7caaaf2e90a07f866f31fb058e5c1608a9965cb5dd91136ea00bfbd67ba44480448dcbaffc092e384f7937bff4234258db30748cb1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC91.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC90.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDC1.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.