6610c71283b3972de637c915a354b4472fc01f3a8a92df0db69ad30d4f1ad623

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 03:16 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32704b7d33da9164c1fe9de827222f84_JaffaCakes118.html
Size

192KB
MD5

32704b7d33da9164c1fe9de827222f84
SHA1

ec00bcf5ce1493e638d444eb71aac3b4e9e2c04f
SHA256

6610c71283b3972de637c915a354b4472fc01f3a8a92df0db69ad30d4f1ad623
SHA512

7dac7d9e14d258f552d4035c406b1f8c52f579452d706f9359654fb583e1fb4702b99c7339227ac141ffee9b468043288499ec73a7c014a9631466b9ff0efea0
SSDEEP

384:kzjqWueIrQIHeGSQg5+YTBz7vj3h0sepWOaCN+EBVxmXVJlFlpgwHzaplfLAHWD0:kzv8eYY9jbr+iXVJr/gwHrTYj0lZV

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307ee1c151a3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421559286"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED3B5C91-0F44-11EF-A759-F637117826CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000409c3b55459108afd497b668d2fe45c9fc51393689a661a90e4e81ae5b10509c000000000e80000000020000200000009c502b24c9cf2af10ec7c4ec70c4cffce27db21912afa7e0162b08dc5bfd6f7590000000551f06115827c786dd7ad99db9ac7fb796e9740088bee468570b9b9d9c9c4acf028376fbe6546ea9dd509cdf5fdaeaacdab7c5387012e77393e2366107cb5d597c6360d4b88edcef67393aa2b915994210d3ce108de8a3e1d8801b8cb01ba5081464d579a8c915179ed24a182b64fa6ae45847ce1e7cb29cd9f93f9e56e98308f274bb7535d69f89f8bf2604f9e9fd9f400000006fbd27886f36ba2c91465fcdb32e67fefc289c24f2c87df882e22373cceb0a0d71a90ce0123a13f8db3ee01de365929ca34c675924e614a8318b1465d7375d05	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e9361000000000200000000001066000000010000200000009c2cb1fb6cda1062a7b53b0194c73c364634817251553db7872a64ab1b92179d000000000e800000000200002000000025074e5f8c3165067f498c6c9ee1c471dc6edee7906cf04ed21efa896c8ae97220000000fa50619c51776bc21f116e701af5971fd25171bf4f879cf6deb050bf3f3ba44d40000000919e63773c445f013815ab07ee687ada4747800dd4f3af70289ab6bda6ca373a5cdb2f643b706b144cfc4ec5e2cc72fc1316f538c6b2ab44ad15bd76c22611e3	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1700	iexplore.exe
1700	iexplore.exe
1232	IEXPLORE.EXE
1232	IEXPLORE.EXE
1232	IEXPLORE.EXE
1232	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1232	1700	iexplore.exe	28
PID 1700 wrote to memory of 1232	1700	iexplore.exe	28
PID 1700 wrote to memory of 1232	1700	iexplore.exe	28
PID 1700 wrote to memory of 1232	1700	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\32704b7d33da9164c1fe9de827222f84_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1232

Network

DNS

www.gaytubemovs.download

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.gaytubemovs.download

IN A

Response
DNS

cdn.popcash.net

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

cdn.popcash.net

IN A

Response

cdn.popcash.net

IN CNAME

popcash-cdn.b-cdn.net

popcash-cdn.b-cdn.net

IN A

143.244.38.136
DNS

adserver.juicyads.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

adserver.juicyads.com

IN A

Response

adserver.juicyads.com

IN A

185.94.237.64
GET

http://adserver.juicyads.com/js/jfc.js

IEXPLORE.EXE

Remote address:

185.94.237.64:80

Request

GET /js/jfc.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: adserver.juicyads.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: nginx
Date: Sat, 11 May 2024 03:17:00 GMT
Content-Type: application/x-javascript
Last-Modified: Fri, 22 Mar 2024 21:09:33 GMT
Transfer-Encoding: chunked
Connection: close
ETag: W/"65fdf38d-1a8e"
Content-Encoding: gzip
GET

http://cdn.popcash.net/pop.js

IEXPLORE.EXE

Remote address:

143.244.38.136:80

Request

GET /pop.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: cdn.popcash.net
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Sat, 11 May 2024 03:17:00 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Server: BunnyCDN-UK1-886
CDN-PullZone: 1818418
CDN-Uid: 81f0ee8a-6b19-463e-a8be-46c199377685
CDN-RequestCountryCode: GB
Cache-Control: public, max-age=2592000
Content-Encoding: gzip
ETag: W/"661ce329-1f3df"
Expires: Wed, 15 May 2024 08:26:57 GMT
Last-Modified: Mon, 15 Apr 2024 08:19:53 GMT
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fH%2FUzh2yhBnJUzlTEYJQtnX%2FoWEviJLKRE7jL2fX%2BXvZixwVZsMPoLsl6fufxC4EBJ2yTJIIQNVhKMGfWHVkhuBFbjF%2F2YmrGyQwZeR2geaMHVHXFzyqNfNU6cyb"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
CF-RAY: 874a8db9fd9d24ab-LHR
CDN-ProxyVer: 1.04
CDN-RequestPullSuccess: True
CDN-RequestPullCode: 200
CDN-CachedAt: 04/15/2024 08:26:57
CDN-EdgeStorageId: 886
CDN-Status: 200
CDN-RequestId: 4dc58f4d51742953036d747dd7df1874
CDN-Cache: HIT
DNS

dcba.popcash.net

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

dcba.popcash.net

IN A

Response

dcba.popcash.net

IN CNAME

haproxy-external-ingress-1634369622.us-east-1.elb.amazonaws.com

haproxy-external-ingress-1634369622.us-east-1.elb.amazonaws.com

IN A

44.210.155.170

haproxy-external-ingress-1634369622.us-east-1.elb.amazonaws.com

IN A

35.168.55.212

haproxy-external-ingress-1634369622.us-east-1.elb.amazonaws.com

IN A

18.211.89.40
GET

https://adserver.juicyads.com/js/fadeinbox.js

IEXPLORE.EXE

Remote address:

185.94.237.64:443

Request

GET /js/fadeinbox.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: adserver.juicyads.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: nginx
Date: Sat, 11 May 2024 03:17:01 GMT
Content-Type: application/x-javascript
Last-Modified: Fri, 22 Mar 2024 21:09:33 GMT
Transfer-Encoding: chunked
Connection: close
ETag: W/"65fdf38d-fa8"
Content-Encoding: gzip
GET

https://dcba.popcash.net/znWaa3gu

IEXPLORE.EXE

Remote address:

44.210.155.170:443

Request

GET /znWaa3gu HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: dcba.popcash.net
Connection: Keep-Alive

Response

HTTP/1.1 204 No Content

Date: Sat, 11 May 2024 03:17:01 GMT
Connection: keep-alive
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
expires: 0
pragma: no-cache
GET

https://adserver.juicyads.com/adshow.php?adzone=479940&mobile=false

IEXPLORE.EXE

Remote address:

185.94.237.64:443

Request

GET /adshow.php?adzone=479940&mobile=false HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: adserver.juicyads.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: nginx
Date: Sat, 11 May 2024 03:17:06 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
X-Powered-By: PHP/5.6.40
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CUR OUR IND STA"
Set-Cookie: surferid=b868c8829a543d00428a2917eb24bb44; expires=Sun, 11-May-2025 03:17:01 GMT; Max-Age=31536000; path=/; SameSite=None; Secure; domain=.juicyads.com
Set-Cookie: juicy_data_1=YTowOnt9; expires=Tue, 14-May-2024 03:17:01 GMT; Max-Age=259195; path=/; SameSite=None; Secure; domain=juicyads.com
Set-Cookie: juicy_data=YToxOntzOjEyOiJqdWljeV9kYXRhXzEiO3M6MToiMSI7fQ%3D%3D; expires=Tue, 14-May-2024 03:17:01 GMT; Max-Age=259195; path=/; SameSite=None; Secure; domain=juicyads.com
Content-Encoding: gzip
DNS

ads.juicyads.me

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

ads.juicyads.me

IN A

Response

ads.juicyads.me

IN CNAME

c7495b9dc5.mjedge.net

c7495b9dc5.mjedge.net

IN CNAME

1230740933.rsc.cdn77.org

1230740933.rsc.cdn77.org

IN A

89.187.167.3

1230740933.rsc.cdn77.org

IN A

195.181.164.20
GET

https://ads.juicyads.me/1x1.gif

IEXPLORE.EXE

Remote address:

89.187.167.3:443

Request

GET /1x1.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: https://adserver.juicyads.com/adshow.php?adzone=479940&mobile=false
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: ads.juicyads.me
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Sat, 11 May 2024 03:17:07 GMT
Content-Type: image/jpeg
Content-Length: 27460
Connection: keep-alive
Last-Modified: Thu, 03 Nov 2016 21:36:07 GMT
ETag: "581badc7-6b44"
X-77-NZT: EwwBWbunAQH31RklAAwBuUwKAQH3HAAAAAwBnJIhJwH3O6cIAA
X-77-NZT-Ray: 9a26d726961e253633e33e6655e77800
X-Accel-Expires: @1715557982
X-Accel-Date: 1712965982
X-77-Cache: HIT
X-77-Age: 2431445
Server: CDN77-Turbo
X-Cache: HIT
X-Age: 2431445
X-77-POP: londonGB
Accept-Ranges: bytes

185.94.237.64:80

http://adserver.juicyads.com/js/jfc.js

http

IEXPLORE.EXE

537 B
3.6kB
6
7

HTTP Request

GET http://adserver.juicyads.com/js/jfc.js

HTTP Response

200
143.244.38.136:80

cdn.popcash.net

IEXPLORE.EXE

190 B
132 B
4
3
185.94.237.64:80

adserver.juicyads.com

IEXPLORE.EXE

466 B
92 B
10
2
143.244.38.136:80

http://cdn.popcash.net/pop.js

http

IEXPLORE.EXE

1.2kB
40.7kB
20
33

HTTP Request

GET http://cdn.popcash.net/pop.js

HTTP Response

200
185.94.237.64:443

https://adserver.juicyads.com/js/fadeinbox.js

tls, http

IEXPLORE.EXE

1.5kB
8.5kB
14
13

HTTP Request

GET https://adserver.juicyads.com/js/fadeinbox.js

HTTP Response

200
44.210.155.170:443

dcba.popcash.net

tls

IEXPLORE.EXE

833 B
4.7kB
11
11
44.210.155.170:443

https://dcba.popcash.net/znWaa3gu

tls, http

IEXPLORE.EXE

1.2kB
5.0kB
12
12

HTTP Request

GET https://dcba.popcash.net/znWaa3gu

HTTP Response

204
185.94.237.64:443

https://adserver.juicyads.com/adshow.php?adzone=479940&mobile=false

tls, http

IEXPLORE.EXE

1.5kB
8.9kB
14
14

HTTP Request

GET https://adserver.juicyads.com/adshow.php?adzone=479940&mobile=false

HTTP Response

200
89.187.167.3:443

https://ads.juicyads.me/1x1.gif

tls, http

IEXPLORE.EXE

1.7kB
35.0kB
21
33

HTTP Request

GET https://ads.juicyads.me/1x1.gif

HTTP Response

200
89.187.167.3:443

ads.juicyads.me

tls

IEXPLORE.EXE

884 B
6.3kB
12
13
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

799 B
7.7kB
10
13
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

747 B
7.6kB
9
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

1.3kB
10.1kB
16
12

8.8.8.8:53

www.gaytubemovs.download

dns

IEXPLORE.EXE

70 B
137 B
1
1

DNS Request

www.gaytubemovs.download
8.8.8.8:53

cdn.popcash.net

dns

IEXPLORE.EXE

61 B
109 B
1
1

DNS Request

cdn.popcash.net

DNS Response

143.244.38.136
8.8.8.8:53

adserver.juicyads.com

dns

IEXPLORE.EXE

67 B
83 B
1
1

DNS Request

adserver.juicyads.com

DNS Response

185.94.237.64
8.8.8.8:53

dcba.popcash.net

dns

IEXPLORE.EXE

62 B
187 B
1
1

DNS Request

dcba.popcash.net

DNS Response

44.210.155.170

35.168.55.212

18.211.89.40
8.8.8.8:53

ads.juicyads.me

dns

IEXPLORE.EXE

61 B
166 B
1
1

DNS Request

ads.juicyads.me

DNS Response

89.187.167.3

195.181.164.20

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c08c23e619cb3e78089bb70ea244be0d

SHA1
51834def14996489bb5fa1d57f0aeb080cb60fcc

SHA256
f7685cdd32e08b96a1132ee22b1fd8c391c01abf8382f8353bc1b971d278b0f6

SHA512
ce3809f21a963e2f894224fce43f2fd84c9e6d1eb952ec1b88e6758f672c9569ec6ef4de9315815d3155efee1cad00171a48ab1eccfeb8d681b89cef0ba81ad9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd16edc82fe02d43a5fd32ec38f71e3b

SHA1
b588a69c1a0d623bbca7a50140b14698594728fe

SHA256
134228a95bd28db8dcb6e2ebcd1ba8836b658af40681f6b80932e320945e377e

SHA512
1679fa48a3d947949d9d2758d4033e202342799b8202b95bf635c096c4aef5bc00e2e3c0a4be9071f961ba1836ba3827f1cd0e901dd523dd8970fe477f2109a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b9416fce012c4618448a3c4dc799fb8b

SHA1
ddea3de465aa27e7ba8adb348538222f7656d5b5

SHA256
560e9407e620452aed9cfb6accbb953efd3a47943dc0f7d91ccd6c1e1d210559

SHA512
45cd8994e8b92714ed279c1ba9596a82b61fe5b98753b1a151af0345332e4466df96a533f9ddc4bfd61aabd5b51a794530cd0b1ef8fadfb1bc5205b3cf69a51a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
79561fed31d5b13676a9b10bc6039df6

SHA1
00bfa5b884c3aa6c6908684f395eab1adc534398

SHA256
4fedd064fe0a429b3cb082d2547a75f9997d406ecb3582b7ae204e31279a2caf

SHA512
dec4fcf881a9533de73a4274124b6e01d9bae48a31a86eed3f2b7f54c17b450fcd517deeb631e886ecf4bbce474932263af171561003015a8c0d2d895b2883e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2c32a80fe33457122e6b7fe7db4b2648

SHA1
7fe5c76f90862bfbf3dc5adcab16c26bbaa15aa5

SHA256
65c2639065b892e188400c95db191c17a3e86f37525d742fcdfe79ae41de4c21

SHA512
776a8d2d5d92fe999b7f1579813a10f713829c64b3cd8fd5535fd00d7d3fd7c5d95b7f8689576ea3502497d8080c9a635641ea8a0501c666fd51794133fa6a1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d220a470b4b248bdac1b47cac0e2b0d9

SHA1
712f5dd640d7b389dcab4790329ebae8ee138f8f

SHA256
909a1a9d0f5afe9f4ae171b34e6139f0673c36e4ebba9482f3a6ee2637cb3a54

SHA512
3f024171bf8aef1c56df5a2eb3fe26917fa4a7f89b758e6171882eaf5f397c82aa80fddb0e6e7955218b1c1f336646ccf88ccdbb946bef5a6c3d96601962bb08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f556c6535575f9c6848503ff1d96693f

SHA1
d844b5866fc54a1fe996bc3eadfd448a93e0865b

SHA256
faa4192a4c27fffbd8222b04da70652b95a67e6f0a4c02c11094b992f9e48cb5

SHA512
f323f26b8afdb3b8d8f13e3df6dfba28f6797f0d45c465b25c5559be26dd355f0263f7051a426b2e2a7b45fbdf33a3710d05f6d8b04724de96f1199497f7d114

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
942365cbebf08b7527eb98cd157bdf28

SHA1
cb5915e8d10c9631e14a67bac739800065c9ce15

SHA256
c75adc5331e47ee12705f51bbdfdadd928b7e8602ad28a336a92e880101fc0ae

SHA512
31253db1f61db20a4574c60ab2da7db537cde1a6c2e8c943b2a1d475c0416db33eaea56cbf6491473b12caee28453adef8d09f8059cbe470553c2bf9431bbba3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50853208fe4a09c10747824f25167f01

SHA1
fb78c2ebd122b83d58111229416afe677f333bd4

SHA256
5c7725ba33e8b77f7c36484c533321eadb56482553592c148a145f18fc783d2f

SHA512
ad08cf839f7438971bd5e366610b02eaa4b46858418feab6b776416ef6e7924393d12beb3888f9842180360048b70a5403531239e7e38e8ae53b00e5cb3e56d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d941956dfb9b85a530c237f9d192d72

SHA1
3c33135c2cc87bebe8046024d3e8d3391ae5071b

SHA256
c01240467acdc6b4f07c0342b0d8425624b7c26d017fd19bf55752d0bb67f7b9

SHA512
860398d246093e929c9c75b5b30077d89d2c5cdd40a0d4c6765f10d626c298748cd4fec1c836833e34247e832411f084a1518c3fedc5fb9fc1e616a4e02aef4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0f13375df259c5f814501ec61708a3fe

SHA1
0d96bf7b851fcd29a7bf32a816b63d110cf04da8

SHA256
7923052fbaa726a814099b97c14d5586f738563e92aaa3d5e860ecb04d89991d

SHA512
c0ce530f48e171e3e46d31782daa4d0a798e675390897e543338991209479e1445151f232e3a049a65741fed43d332878578ff2cc512f57bf9ccaca04338c142

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4da522ddd271a079fe170005e2b1bd8e

SHA1
9c344a6ed6228b5cac9466efe7e2331b3fec9208

SHA256
6f548e1e8136ab1af1069791edda043cc39d4ecf2e781fe1a34f68cb42e63426

SHA512
87e41666bdc99fbfa786e4eae4f5051800a8092614bc26e8a2dfd8afcab7d9b26e8fd76026cebddf0785536cc3ed25d7dc198cde717452050b67e3827e0e2c1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1895ca49531df12889c4a4343ab4e996

SHA1
99dbb1d77dc969158b34d97cf4b81aac5fc0d144

SHA256
d89aef0f43b78989749df497323a48916961d590e8e0420d545978af6a31f43c

SHA512
36051b2c046b49b23f7ce8192c71bf3d20d83fe4e8fe212451d135b03c7cc38582757a8cc421076c04dc8ffbbea8a1a7095d3d3d10b7506c7c616ff45f276f99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3255828ba72e3a05faae27078f425fdb

SHA1
18c8aa390186181622526325556e444feeb3da58

SHA256
9a82ef5018af83ad3b314d8ecd730c7836242d7fec5212dd792503b12679b85e

SHA512
5bb0726164906b8df3b83f6996d2bdc8a9525e5fdcc415d755f7896b12557c306e22f3103085f047a1b1c372ae42fd6a22be138c061bc27cfd1aceb7a12c1281

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9bb3d57bb692d0b93f0a19274d44d760

SHA1
f5d567c192e0481438681ca5a31779d5ac7ad92a

SHA256
3104839a64b835a8eb6e91aee218832ac590ced615e4eaf84fb67e6b62cd87bc

SHA512
904aea79824261d0a7b719ec5b46eb4e4f689e5c776f2f8f4e6c12dc4d4adc873ce882c8f808c2963385ec8c1a6a02c76079c65cf87449523cc8f6ada4c0cd17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17f078c299e64e68b399bcc055000b09

SHA1
88ca5248148a33ea910f2ce76c8bfcd45a7fb9fc

SHA256
a5cbe47e09a97953f518d07c4784edc2004a9a460f5ef20d6a8557e00cd23a24

SHA512
74fe8e344a2ea7c6301d5840f68d05e9354e2254d7c00e5f33a5cab49820ab984c79985b57ac121978d4b35dfdd1150adb717ff30d901bda00eea7c37f363875

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14ad50980266e8db2142fa7fc63cec75

SHA1
6cde72ca2dbf75345a6654ee867dd02db8446522

SHA256
27a1242a0218c4d32b53dc11b7d2c1b909d48eeb3add07e045bf00d5e22ee51b

SHA512
82ee6f0f69c34a863cdc3c28bc916ddfdc64792d91048ff3a0cb7d6234f00fdce98bfb8e80903fd6136b9ebbb52c228fa6b47ee865acb64d74e8de16de234bc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db6d479251d44db80a927eef12557be0

SHA1
5c40a932d17ae2c770a46db0baff9cabc84ae314

SHA256
6522eb079be8ca41e75c75b1349ddf3efaf58af32ef1d8a1d0e251bdec6fe47b

SHA512
785f7de9699037ece391036af73f3b13531bab86abc2389b8f1e44a20e8468687bfa7df8b7f4472bb951afe5befbcda783b202b1c703313f662f3c2e4d5013f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b7442e8e4ea18854b11bd7bbafe231e

SHA1
a67f48949da460dd9dd2cfac5f0432d0d9367537

SHA256
537925483dedd9d81ba64f7d45e53d829ea652ce0b0db2687c2a8e5a126997b6

SHA512
3d806e5aea3753f8d36a2392c61012a91f0910782f503f7b910d0d3b6cdc1c5bf0507ab47688ccad3686dce154507a9d906a5a3c4fdf51b67aaedbd35c5adb7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab10C4.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1135.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.