55618cca9fa2a237b02b5b796c730a32185db508d338f2c081543d0b9f7139e2

Analysis

max time kernel
131s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 09:48 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4ed2a96d659082a478de651c2886e1c_JaffaCakes118.html
Size

201KB
MD5

a4ed2a96d659082a478de651c2886e1c
SHA1

ffb77a24e652f966d45f895367f4bd8071c63f04
SHA256

55618cca9fa2a237b02b5b796c730a32185db508d338f2c081543d0b9f7139e2
SHA512

40dbde879c858f354cd8eba97282ef55f7c56ad080995001615e16707c355ed7927fb654277d7156b6871758cd4ff76cb3d47d8d9c7ffb1b074b1f0e415e6bb6
SSDEEP

1536:kaKgWoheVhbVtn2R9d+KXIez8OAtnGNTUBzyF4bwnNGvM:dKhpa

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0BD7B1A1-296A-11EF-B8F6-D6B84878A518} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a23000000000200000000001066000000010000200000004236c842b2f8cfcdb94c09d5ba8feb7378ecb18c964eec02a78ff7340e419991000000000e80000000020000200000006d21dfe594977a4202e1c78e7adff79be7f7d19ab7d12190e969f8f5ff970f9690000000a337198f99bf081a72261b5d2b212ce873c931283de09f69266a56d1dfb8dcacb0a2a5ab8f4230f4f448152c91bc50928af53f119ca7caaac2263c9ff6598d8cd41fa8869752a2678cb18b5ac49697cf3a392b1b54fcf3d7d1c19e2210e5df081026931cb9939f5b3667aeab0eb3955a692faed34c281a2acea1680ca6740b33117cd22d2a94bab65676cacee6e746384000000057357384d427da0310448ec68e2d1cbfdc83c2b1f730db293aa808344c94561764db036fb7a34fc7b23b52100dfdec4f8f1a3c98a121cc9d40a5c9e8f1f41d02	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424433981"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a230000000002000000000010660000000100002000000096377af25fdb57b47953f01ad7bd1e977629847498ab4290000b20ae89f346c6000000000e8000000002000020000000100435eed8e94bbf2003960b030ec3932931029367f9bd5fb4e0af668db498f4200000002818dad6c16a71ff645f3c6c2acdce344aa4679ed62d83f2f74cd92f9addcf0240000000d442fe7213b32a43829e6d8d56502f772933de6c9ae2c65c3c2d2f85b63228da89278984dc90776a19bdd2a9d1a9362eaf9f32dd8a2600e454191ba2a9348d3f	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90ee2b1c77bdda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2092	3016	iexplore.exe	28
PID 3016 wrote to memory of 2092	3016	iexplore.exe	28
PID 3016 wrote to memory of 2092	3016	iexplore.exe	28
PID 3016 wrote to memory of 2092	3016	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a4ed2a96d659082a478de651c2886e1c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2092

Network

DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

masterhost.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

masterhost.ru

IN A
DNS

masterhost.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

masterhost.ru

IN A
DNS

masterhost.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

masterhost.ru

IN A
DNS

masterhost.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

masterhost.ru

IN A
DNS

masterhost.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

masterhost.ru

IN A
DNS

ads.serveuser.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

ads.serveuser.com

IN A
DNS

ads.serveuser.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

ads.serveuser.com

IN A
DNS

ads.serveuser.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

ads.serveuser.com

IN A
DNS

ads.serveuser.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

ads.serveuser.com

IN A
DNS

ads.serveuser.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

ads.serveuser.com

IN A
DNS

counter.yadro.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

counter.yadro.ru

IN A
DNS

counter.yadro.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

counter.yadro.ru

IN A
DNS

counter.yadro.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

counter.yadro.ru

IN A
DNS

counter.yadro.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

counter.yadro.ru

IN A
DNS

counter.yadro.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

counter.yadro.ru

IN A
DNS

dd.cb.b0.a1.top.list.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

dd.cb.b0.a1.top.list.ru

IN A
DNS

dd.cb.b0.a1.top.list.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

dd.cb.b0.a1.top.list.ru

IN A
DNS

dd.cb.b0.a1.top.list.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

dd.cb.b0.a1.top.list.ru

IN A
DNS

dd.cb.b0.a1.top.list.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

dd.cb.b0.a1.top.list.ru

IN A
DNS

dd.cb.b0.a1.top.list.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

dd.cb.b0.a1.top.list.ru

IN A
DNS

ads.serveuser.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

ads.serveuser.com

IN A
DNS

ads.serveuser.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

ads.serveuser.com

IN A
DNS

ads.serveuser.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

ads.serveuser.com

IN A
DNS

ads.serveuser.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

ads.serveuser.com

IN A
DNS

ads.serveuser.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

ads.serveuser.com

IN A
DNS

dd.cb.b0.a1.top.list.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

dd.cb.b0.a1.top.list.ru

IN A
DNS

dd.cb.b0.a1.top.list.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

dd.cb.b0.a1.top.list.ru

IN A
DNS

dd.cb.b0.a1.top.list.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

dd.cb.b0.a1.top.list.ru

IN A
DNS

dd.cb.b0.a1.top.list.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

dd.cb.b0.a1.top.list.ru

IN A
DNS

dd.cb.b0.a1.top.list.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

dd.cb.b0.a1.top.list.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

masterhost.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

masterhost.ru

IN A
DNS

masterhost.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

masterhost.ru

IN A
DNS

masterhost.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

masterhost.ru

IN A
DNS

masterhost.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

masterhost.ru

IN A
DNS

masterhost.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

masterhost.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A
DNS

razgovorchik.ru

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

razgovorchik.ru

IN A

No results found

8.8.8.8:53

razgovorchik.ru

dns

IEXPLORE.EXE

305 B
5

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru
8.8.8.8:53

masterhost.ru

dns

IEXPLORE.EXE

295 B
5

DNS Request

masterhost.ru

DNS Request

masterhost.ru

DNS Request

masterhost.ru

DNS Request

masterhost.ru

DNS Request

masterhost.ru
8.8.8.8:53

ads.serveuser.com

dns

IEXPLORE.EXE

315 B
5

DNS Request

ads.serveuser.com

DNS Request

ads.serveuser.com

DNS Request

ads.serveuser.com

DNS Request

ads.serveuser.com

DNS Request

ads.serveuser.com
8.8.8.8:53

counter.yadro.ru

dns

IEXPLORE.EXE

310 B
5

DNS Request

counter.yadro.ru

DNS Request

counter.yadro.ru

DNS Request

counter.yadro.ru

DNS Request

counter.yadro.ru

DNS Request

counter.yadro.ru
8.8.8.8:53

dd.cb.b0.a1.top.list.ru

dns

IEXPLORE.EXE

345 B
5

DNS Request

dd.cb.b0.a1.top.list.ru

DNS Request

dd.cb.b0.a1.top.list.ru

DNS Request

dd.cb.b0.a1.top.list.ru

DNS Request

dd.cb.b0.a1.top.list.ru

DNS Request

dd.cb.b0.a1.top.list.ru
8.8.8.8:53

ads.serveuser.com

dns

IEXPLORE.EXE

315 B
5

DNS Request

ads.serveuser.com

DNS Request

ads.serveuser.com

DNS Request

ads.serveuser.com

DNS Request

ads.serveuser.com

DNS Request

ads.serveuser.com
8.8.8.8:53

dd.cb.b0.a1.top.list.ru

dns

IEXPLORE.EXE

345 B
5

DNS Request

dd.cb.b0.a1.top.list.ru

DNS Request

dd.cb.b0.a1.top.list.ru

DNS Request

dd.cb.b0.a1.top.list.ru

DNS Request

dd.cb.b0.a1.top.list.ru

DNS Request

dd.cb.b0.a1.top.list.ru
8.8.8.8:53

razgovorchik.ru

dns

IEXPLORE.EXE

305 B
5

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru
8.8.8.8:53

masterhost.ru

dns

IEXPLORE.EXE

295 B
5

DNS Request

masterhost.ru

DNS Request

masterhost.ru

DNS Request

masterhost.ru

DNS Request

masterhost.ru

DNS Request

masterhost.ru
8.8.8.8:53

razgovorchik.ru

dns

IEXPLORE.EXE

305 B
5

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru
8.8.8.8:53

razgovorchik.ru

dns

IEXPLORE.EXE

305 B
5

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru
8.8.8.8:53

razgovorchik.ru

dns

IEXPLORE.EXE

305 B
5

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru
8.8.8.8:53

razgovorchik.ru

dns

IEXPLORE.EXE

305 B
5

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru
8.8.8.8:53

razgovorchik.ru

dns

IEXPLORE.EXE

305 B
5

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru

DNS Request

razgovorchik.ru

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...