d8fd6c539ab96376f5b41093cce13792144565e7a4f722e4bc7fdc7739559022

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 10:06 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

398c7443c25ef4ff416adf9782c72d52_JaffaCakes118.html
Size

15KB
MD5

398c7443c25ef4ff416adf9782c72d52
SHA1

c9de25a590d068fdab75cf2ba9ed528ce46fe0ac
SHA256

d8fd6c539ab96376f5b41093cce13792144565e7a4f722e4bc7fdc7739559022
SHA512

0186c1db64ffd01d0c7ea9d5461f05e139937847b4d2965ecc3710cc1e6f2261c744424761fad7248411a27c0972efecaaa29f79fa1b13f02a7eea25265c9382
SSDEEP

384:eDp3/b9JdmAEAEwd0OOO9DYIj7ceaYTbYzUiPJy9jnKy:idTdmAEAR2OOO9cIPc6QAiPyX

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42EB8361-1047-11EF-BAE0-E64BF8A7A69F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421670239"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000389c3ec86538f621dceff79ae360af62b54465659c83630d3b6357e79a21b5f2000000000e80000000020000200000005ec1e9201ee741e2588c086309a5929fb3331ca318f2e09365a84b62b52e9f35200000006fea8fcd010eae5251bdc6486dc96bcd1126638728b7a8f67c26e7dae78c0f0c40000000329fd6f3dca8aa7da451fc789278e59cc637c284ea37e64af378081d45e9770c03ad75850d3302bd16c5f3647204d6c4a3c59a95f9a8d51bef14888bcb07a7a4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000eb55b29517e1d8df480e418079e9ed06b9adc1d6fee483e525e87693e7f4fda0000000000e800000000200002000000095d71a5ba4f2ad0d2bb3e008defadda07a9847d8102278d5010130dcc5284d759000000087f5d9df187b5529e968821bc21bbb83f56947e0e487de7d03982064258646812842eacb49191ad81a39fb7e6282596f865e177d5d17fde01346d9682bc8cd2f5ce002d7692fcea3242eec6835afa5c0c3c0f9f1d236127e32f4c3137e3bf7c3edaecf445a8dbb9444ef1536d44281a50b262388d25bc9d999478f1fcfe4a1a1c4bd9ddf54ab94aa7d45db94d322a5ea4000000003f24785f83e13322a2cfc83f1364675af4b53d72b5ad0de8d27439e9cc9d8969d16366b38e2385dd67c7a3d51d4506f7fb00521e84394a022b341be37cb051c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8093c81754a4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1612	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1612	iexplore.exe
1612	iexplore.exe
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE
2996	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2996	1612	iexplore.exe	28
PID 1612 wrote to memory of 2996	1612	iexplore.exe	28
PID 1612 wrote to memory of 2996	1612	iexplore.exe	28
PID 1612 wrote to memory of 2996	1612	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\398c7443c25ef4ff416adf9782c72d52_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2996

Network

DNS

ajax.googleapis.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

ajax.googleapis.com

IN A

Response

ajax.googleapis.com

IN A

142.250.179.234
DNS

www.theasianlad.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.theasianlad.com

IN A

Response
DNS

i.ytimg.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

i.ytimg.com

IN A

Response

i.ytimg.com

IN A

142.250.200.22

i.ytimg.com

IN A

142.250.200.54

i.ytimg.com

IN A

216.58.201.118

i.ytimg.com

IN A

216.58.204.86

i.ytimg.com

IN A

216.58.213.22

i.ytimg.com

IN A

216.58.212.214

i.ytimg.com

IN A

172.217.169.54

i.ytimg.com

IN A

142.250.179.246

i.ytimg.com

IN A

142.250.180.22

i.ytimg.com

IN A

142.250.187.214

i.ytimg.com

IN A

142.250.187.246

i.ytimg.com

IN A

142.250.178.22

i.ytimg.com

IN A

172.217.16.246
DNS

maxcdn.bootstrapcdn.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

maxcdn.bootstrapcdn.com

IN A

Response

maxcdn.bootstrapcdn.com

IN A

104.18.11.207

maxcdn.bootstrapcdn.com

IN A

104.18.10.207
GET

http://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js?ver=4.1.18

IEXPLORE.EXE

Remote address:

142.250.179.234:80

Request

GET /ajax/libs/jquery/1.10.2/jquery.min.js?ver=4.1.18 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: ajax.googleapis.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="hosted-libraries-pushers"
Report-To: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
Timing-Allow-Origin: *
Content-Length: 32954
Date: Sun, 12 May 2024 10:06:14 GMT
Expires: Mon, 12 May 2025 10:06:14 GMT
Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000
Last-Modified: Tue, 03 Mar 2020 19:15:00 GMT
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
GET

http://i.ytimg.com/vi/TP8RB7UZHKI/mqdefault.jpg

IEXPLORE.EXE

Remote address:

142.250.200.22:80

Request

GET /vi/TP8RB7UZHKI/mqdefault.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: i.ytimg.com
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Vary: Origin
Timing-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Content-Type: image/jpeg
Date: Sun, 12 May 2024 10:06:14 GMT
Expires: Sun, 12 May 2024 10:06:44 GMT
Cache-Control: public, max-age=30
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 1097
X-XSS-Protection: 0
GET

http://i.ytimg.com/vi/3Nlt4_AuYZs/mqdefault.jpg

IEXPLORE.EXE

Remote address:

142.250.200.22:80

Request

GET /vi/3Nlt4_AuYZs/mqdefault.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: i.ytimg.com
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Vary: Origin
Timing-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Content-Type: image/jpeg
Date: Sun, 12 May 2024 10:06:14 GMT
Expires: Sun, 12 May 2024 10:06:44 GMT
Cache-Control: public, max-age=30
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 1097
X-XSS-Protection: 0
GET

https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/font-awesome.min.css

IEXPLORE.EXE

Remote address:

104.18.11.207:443

Request

GET /font-awesome/4.4.0/css/font-awesome.min.css HTTP/1.1
Accept: text/css, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: maxcdn.bootstrapcdn.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Sun, 12 May 2024 10:06:14 GMT
Content-Type: text/css; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
CDN-PullZone: 252412
CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74
CDN-RequestCountryCode: US
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31919000
ETag: W/"0831cba6a670e405168b84aa20798347"
Last-Modified: Mon, 25 Jan 2021 22:04:54 GMT
CDN-ProxyVer: 1.03
CDN-RequestPullSuccess: True
CDN-RequestPullCode: 200
CDN-CachedAt: 11/29/2022 01:44:14
CDN-EdgeStorageId: 718
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
X-Content-Type-Options: nosniff
CDN-Status: 200
CDN-RequestId: ef9ffecc01e87d0916e00062c24f9f3b
CDN-Cache: HIT
Content-Encoding: gzip
CF-Cache-Status: HIT
Age: 4714906
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Server: cloudflare
CF-RAY: 8829984d2ab94179-LHR
alt-svc: h3=":443"; ma=86400
GET

https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/fonts/fontawesome-webfont.eot?

IEXPLORE.EXE

Remote address:

104.18.11.207:443

Request

GET /font-awesome/4.4.0/fonts/fontawesome-webfont.eot? HTTP/1.1
Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Origin: file:
Accept-Encoding: gzip, deflate
Host: maxcdn.bootstrapcdn.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Sun, 12 May 2024 10:06:14 GMT
Content-Type: application/vnd.ms-fontobject
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
CDN-PullZone: 252412
CDN-Uid: b1941f61-b576-4f40-80de-5677acb38f74
CDN-RequestCountryCode: FR
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=31919000
ETag: W/"45c73723862c6fc5eb3d6961db2d71fb"
Last-Modified: Mon, 25 Jan 2021 22:04:54 GMT
CDN-CachedAt: 03/06/2024 16:37:44
CDN-ProxyVer: 1.04
CDN-RequestPullCode: 200
CDN-RequestPullSuccess: True
CDN-EdgeStorageId: 951
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
X-Content-Type-Options: nosniff
CDN-Status: 200
CDN-RequestId: 836de1d80938b35ed8414635a3b3b66a
CDN-Cache: HIT
Content-Encoding: gzip
CF-Cache-Status: HIT
Age: 4238596
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Server: cloudflare
CF-RAY: 8829984eccbc4179-LHR
alt-svc: h3=":443"; ma=86400
GET

http://i.ytimg.com/vi/7K8RksVMXIc/mqdefault.jpg

IEXPLORE.EXE

Remote address:

142.250.200.22:80

Request

GET /vi/7K8RksVMXIc/mqdefault.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: i.ytimg.com
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Vary: Origin
Timing-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Content-Type: image/jpeg
Date: Sun, 12 May 2024 10:06:14 GMT
Expires: Sun, 12 May 2024 10:06:44 GMT
Cache-Control: public, max-age=30
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 1097
X-XSS-Protection: 0
GET

http://i.ytimg.com/vi/j-e2kIB3KJc/mqdefault.jpg

IEXPLORE.EXE

Remote address:

142.250.200.22:80

Request

GET /vi/j-e2kIB3KJc/mqdefault.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: i.ytimg.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Type: image/jpeg
Vary: Origin
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube"
Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
Timing-Allow-Origin: *
Content-Length: 16299
Date: Sun, 12 May 2024 10:06:14 GMT
Expires: Sun, 12 May 2024 12:06:14 GMT
Cache-Control: public, max-age=7200
ETag: "1455063805"
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
GET

http://i.ytimg.com/vi/JzP6XTyZ9Wo/mqdefault.jpg

IEXPLORE.EXE

Remote address:

142.250.200.22:80

Request

GET /vi/JzP6XTyZ9Wo/mqdefault.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: i.ytimg.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube"
Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
Timing-Allow-Origin: *
Content-Length: 13678
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sun, 12 May 2024 10:06:14 GMT
Expires: Sun, 12 May 2024 12:06:14 GMT
Cache-Control: public, max-age=7200
ETag: "1419547316"
Content-Type: image/jpeg
Vary: Origin
Age: 0

142.250.179.234:80

http://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js?ver=4.1.18

http

IEXPLORE.EXE

1.2kB
36.3kB
20
29

HTTP Request

GET http://ajax.googleapis.com/ajax/libs/jquery/1.10.2/jquery.min.js?ver=4.1.18

HTTP Response

200
142.250.179.234:80

ajax.googleapis.com

IEXPLORE.EXE

190 B
92 B
4
2
142.250.200.22:80

http://i.ytimg.com/vi/TP8RB7UZHKI/mqdefault.jpg

http

IEXPLORE.EXE

563 B
1.6kB
6
5

HTTP Request

GET http://i.ytimg.com/vi/TP8RB7UZHKI/mqdefault.jpg

HTTP Response

404
142.250.200.22:80

http://i.ytimg.com/vi/3Nlt4_AuYZs/mqdefault.jpg

http

IEXPLORE.EXE

563 B
1.6kB
6
5

HTTP Request

GET http://i.ytimg.com/vi/3Nlt4_AuYZs/mqdefault.jpg

HTTP Response

404
104.18.11.207:443

https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/fonts/fontawesome-webfont.eot?

tls, http

IEXPLORE.EXE

3.0kB
88.0kB
44
74

HTTP Request

GET https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/font-awesome.min.css

HTTP Response

200

HTTP Request

GET https://maxcdn.bootstrapcdn.com/font-awesome/4.4.0/fonts/fontawesome-webfont.eot?

HTTP Response

200
104.18.11.207:443

maxcdn.bootstrapcdn.com

tls

IEXPLORE.EXE

784 B
5.8kB
10
10
142.250.200.22:80

http://i.ytimg.com/vi/7K8RksVMXIc/mqdefault.jpg

http

IEXPLORE.EXE

563 B
1.6kB
6
5

HTTP Request

GET http://i.ytimg.com/vi/7K8RksVMXIc/mqdefault.jpg

HTTP Response

404
142.250.200.22:80

http://i.ytimg.com/vi/j-e2kIB3KJc/mqdefault.jpg

http

IEXPLORE.EXE

891 B
18.1kB
13
17

HTTP Request

GET http://i.ytimg.com/vi/j-e2kIB3KJc/mqdefault.jpg

HTTP Response

200
142.250.200.22:80

http://i.ytimg.com/vi/JzP6XTyZ9Wo/mqdefault.jpg

http

IEXPLORE.EXE

845 B
15.6kB
12
15

HTTP Request

GET http://i.ytimg.com/vi/JzP6XTyZ9Wo/mqdefault.jpg

HTTP Response

200
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

753 B
7.7kB
9
13
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

753 B
7.7kB
9
13
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

779 B
7.6kB
9
12

8.8.8.8:53

ajax.googleapis.com

dns

IEXPLORE.EXE

65 B
81 B
1
1

DNS Request

ajax.googleapis.com

DNS Response

142.250.179.234
8.8.8.8:53

www.theasianlad.com

dns

IEXPLORE.EXE

65 B
138 B
1
1

DNS Request

www.theasianlad.com
8.8.8.8:53

i.ytimg.com

dns

IEXPLORE.EXE

57 B
265 B
1
1

DNS Request

i.ytimg.com

DNS Response

142.250.200.22

142.250.200.54

216.58.201.118

216.58.204.86

216.58.213.22

216.58.212.214

172.217.169.54

142.250.179.246

142.250.180.22

142.250.187.214

142.250.187.246

142.250.178.22

172.217.16.246
8.8.8.8:53

maxcdn.bootstrapcdn.com

dns

IEXPLORE.EXE

69 B
101 B
1
1

DNS Request

maxcdn.bootstrapcdn.com

DNS Response

104.18.11.207

104.18.10.207

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40400f02fadd440393dfff949cb2eaeb

SHA1
764faae299fa7f71189f1c94ad77beba75185b2e

SHA256
74ca2131b0c221ffb93ca9af6c45f0be29da40723dc8ef887f012347b9402413

SHA512
994239ae7a9faffa9eb3be31c49e082d63125287e0755af4e8277239930b22527a579edd3b22f11e8b79c35add61b141028458e97954c850d704168c8c2b65d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8686d612e88c06d017bcdf0dfdf916a

SHA1
24aba71b0d66beae0fff2ec777218b84f6fafe82

SHA256
ecc1fd78ea132a4edd55d3a5bc4e93dc63be3c932290efdbf51a3ee1f5ed6a3c

SHA512
3ba87eb2b7ef511210cad122fd0a7ecca8076ae40ef5c15fdcde88f8af809f264f8247d17431207fe90045f0c2c573064f3307b1ed5538fc70ede85871d4635f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
809fcdffb6d4cc4af04a4f7dfeee7f0b

SHA1
761affe55728f00c55ddc9896f399c8b22b4abe7

SHA256
28a76a6738ea9a263a79e77ad452756c4ec80c58abb73b990b55bb4c997bc275

SHA512
3b6bc67b2efe352c9c4deb62f6565b630e819c3e69bbd3724fcd8ddae2c8f50711b74b766973bab65c4ca902a547565fc66e8ed1ebd70872884eb6702ce5078c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4586d40e18db3dff05f67ad1f19a67cf

SHA1
073e74d407b86b6689cf80ec663e260fcf17993b

SHA256
6ecd4c05caccdc49bfeba57a700578a0b0f887479ebe38043ad91ebf93cb3aa1

SHA512
7c9743441b670379c3eb8b7ab478d7886ace2071387f4e4538fc7e3f5a03a009259a50e1c1c8960165dc159975daeb0caf83d1303bc3f32dfe1cdb9d2a738fb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a45034aa2b1191560d728c0a950cb01e

SHA1
f7115b1cb42a2e1a43055b73a963715bef6ed1e9

SHA256
5e8557e20cb0f0d2e0ee71399fc63e8955ee591c0dbf2e4d2623a52a6b4006e1

SHA512
dc8d3e7df6aae2de1e41f5af807458509f699bdaf97dcf7d796b2bb6ad17e35db1f6af89bac28f626c63cfc42c04a46866432035e2b0cfae9b596afe8922f4a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
474d56543a7f922e5a35a144b73de64c

SHA1
fe3b5c8bf7b592ce82ed7ff2280121103134e830

SHA256
358145e669eed77f036c9e6b482499d7850b3e242fece5ee32bedec7dde2f00d

SHA512
e9346df0c111914f2c7412005c478d09fab42ae5f997561abae55adebd3097141e606fc885791dbcb96c58214c5a8c82133e031e1fc847410c94957b491ae449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e34aa81cc91308f5b0e21d50438a0d45

SHA1
5029eeb271998143458800c8967faf563e046198

SHA256
ae70dfbd37ea8dacb814a4d14136a9ae562e6afc43bb836a7bbeac174c11b574

SHA512
c611bc16959e78b0e81de3879c0438b18714c1efd277f7409e8434120c30baeda18ed82700947498a5d03dc12c89de2120e53ce28b0d6f2b282bc4f9691083a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6eb06ccd11bfc3963643600931a55ffa

SHA1
9dc319961ffde07b4be547110b3bad5d0a53969a

SHA256
17c9c40f50b05fac1b2084179172aaef7ea1b1aa4d4612096dc77257bb672ffd

SHA512
562f0b9005f029f05613159567bba4d3a932fb6e02766254de24fa06a785e3ce2869a8cbe01bdfa9b744a7ae146350b394d364d7ca308f8b024cbb0023f26ad2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1417a74bfc6386515cc6a647b1ab63a

SHA1
403b39700ed75a54ce15f5f4458008732627abf3

SHA256
4368351f6a821b763a69164f470899011394be03cc8ac80a563c04f248494440

SHA512
c0b1400ce7db671e06373cbdb51a262bd24110966a0d14d306192019adf76ab517c283bb71db6aa1f26e84480a54f658d429496ab4597c80a2c17b3fb67a788b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cfcacb27d4f914d75d09549b2d2baaa

SHA1
72e14a3a1a08e7883fdc37609938a3ce57fa956e

SHA256
603f579a6d918f9b7604433db5ba00b5d3de897a82f156d34efc1bbc0a450762

SHA512
f90905bf3d24e00c0394b296838b16a8c67ce77fee6f5b0a1ad2c4c48950a58c5e32be2b242a80d2c80cca64e59a0ba410b3a6d5d533106320840ea78277624c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2cd81a75a04b14f6d9c73bc3baeb94c2

SHA1
74fc89db144d06f30803b60da64549561746971c

SHA256
933d5a2da615892efd32d990337890090725c980e63161e15fbc5efcdd22c896

SHA512
d97e9ed278bc1ee9255c1458b814507c983168afd5663beac1ca481e246a8b1ff90b96bb8f5d7a1ae7aa22f34e32033b044624374aebd9c21777546cc32f55e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
371763857659e7a911007edc55bd7f94

SHA1
3f04da1b2e73b1ad544742107c98d98bdccddebf

SHA256
b922b48603ab3089ea94b91425d6bb6d08d09bd0270d2419b3b893b28e2f34c0

SHA512
8119e4582c87dc47f434e29f8e8b864f7bc4c6e8010de42c883df97808e3162fe5196bcb755045f7186fd8c9d54c255fc542699c994932ff58d62055a664bcbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92f3faff5242c6656568b8ff617ed51f

SHA1
52fbd038c568f409c39c69d9d30cae7ebbd57af6

SHA256
4cf52596b46dd90a54db82589f4f6b0f97d36eb2c272bff4c02ae55615598ea4

SHA512
a379c5ee7e31096644bdff88d2aaaab57ca4b8e0137bf97b292d3fbd06044a2dd89f7a5cecd50984898c8d4acb71b4e30ad383c83c9737d41a2baac18aba3014

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b39a6b63ef4b67f8105580cfe18ddef8

SHA1
21ef043d98eb60c3a0cdc9556c4ce13b32b768fe

SHA256
e61b9b2d955dffe7538a0c28cb0d6e52253088edfe8f081199214369276aaa26

SHA512
7a9259c424ca797a79212182353e67dc1cee92e92fdd4e40d0ca2882c22511f3e9ff84f2dce3e84a5bec58306e666e278bac33fcd5ed76165aff42e05cdb2464

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5a4b8dc49441e12a5e81b39b98326adc

SHA1
2b16bb3fdbdf642c7502e957535842d345065f86

SHA256
364ed36816b6da7ff3f87186f6075ebc21cc5b67ebc943cdf82feb70fa61cec6

SHA512
77678f2dd1cecb758c01b544c8ff3481bfe6e555aa708a2842355ad7d90402fb49d3fda859d3735b30ed6ef24ae8fa5017d9394a7a0cdfa67b23a0ec1e1fe5b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c755968f66f8c623dbf77efea24fd624

SHA1
83faaabb50e966818e8de038dfba8c81f04ae0d0

SHA256
b0d6d79c24bcbf8b7d2ad642dbbd67e5256fe7d33535bf7204ea098152f53aca

SHA512
fbbb7156c47542c95097a96077c87a51f9edc7e9e63b30d314db05c4e60af7b72641b00dfaea6a53eac2c544b4365e735383b0890eda84f65bba87a0211193f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77e30ce5ab3153e5e71c59ef848e3de8

SHA1
b6d5948078a4794f88a18422b0d06c1161f59c0e

SHA256
399bd191bdae2eae0c7ebc69aab57fac37c8ca90a90468533bde11d997d41d8c

SHA512
87553d4a6230b8b854a81489a45bf8d231e3ae088b91accee9c25d362cf58d35569b96918357d1416e1727c218bd8cee1359826cdd295bb733d519256427b6f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
411c728646716650a971146757282d09

SHA1
6fb39b127f1ad8f7ba720b34e3510916c8d7a1eb

SHA256
fc157e5e76c8ca42ae0b5cca9249d1892b5eb72e45de7dd6080cd5b71be77d61

SHA512
7c1bb06fbb8e982506c4760865608a5fd25971c96f82c8cb19fcd7ed0f3b26caa7d32de2da6d6dd2118277985f904bff0bdd4f208690fc4e9e66bec84179a2c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
75d6d27f8461d66f19d5ba5f05eb0aeb

SHA1
e8c7459f16893a885fdae875680ab89812644ee1

SHA256
16952aa3f106e8f484776411a7139e3f27bafbf449b886d4d0d629d9da6c8967

SHA512
ddaef803b0351d6d8871128d312ce449b7e2944530b3a68f5f8c7c6d20c4cbde740eef6a8bbd9042d5823ef9d821d51b908e4f099c2458142cd126c094b1f513

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2a0361f8e5ac5248fe864309a042a33

SHA1
3077212e7ccd9f83cfcb17b35925c0c5a34e8724

SHA256
109b11d32792cd5bfd05b8011ed9cae640942b156696ba525e2b12739772e202

SHA512
35a0676cd97d0d698646d15ee24048279f7a87f06233f1009e86a518161611e224f405eb5fbbadef7f13add00e6031378257c005f2b6a2c12094f270df5b45ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bc7fb35abcf17385e5b6ec15fe52cdea

SHA1
511af1e14659b3ca65be5c75812d72e2efbd3256

SHA256
fe8beeb7b894c051e9d402f589d6a1e362122311dd6d9e9bd7f1bf817af1e5a2

SHA512
ff6918a78bf6d081f3a8b30a173161057a5f642b7cb904ea3c3dd25489a475fd279d527f14ef919b942a98827fbb42f1b21530760505d931bb53567e163ceba6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2203.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2206.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.