14be0528b532d42591aeb4f398f5b900325af81c485d5b80689dc9c8131497a1

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 14:18 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

397ac5e45fed842bd346c04d5d4b92eb_JaffaCakes118.html
Size

122KB
MD5

397ac5e45fed842bd346c04d5d4b92eb
SHA1

efc6564b2528d1cb8192f8c87fff5bbbd4ed136a
SHA256

14be0528b532d42591aeb4f398f5b900325af81c485d5b80689dc9c8131497a1
SHA512

c0e05bd27dfc2691dd201a81943b2951ce8184c7976a5f4999cca9943c5a49275cf60b9d692ef11fb822a49679e928a3ad29cb696dbb476fc11639e2a9d4a462
SSDEEP

1536:G9DMLJjN/AdWvTnhjDf2/aAOga5cZeuzBLzAxhQEGix8mBfzB25xkZsX57Y+NeLM:G6AdOgVKozWkvwIH

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "426869367"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000078bd86a5a66b03f44915118ed2837315cbf96dbdf9334d5559a002bff397ba74000000000e80000000020000200000003e6077aae41cb1951ff44c6a26f9a2a6e312f075fb9037d04109bff650f5e914200000004cca1e3a499b35a5c1e309836edd96bc8d7259b410b32e7d3e592ce1fa312a9740000000548b725ead3fd58b4e8ac0a393f96f2e3ca06aa15c48815d32d76af92f36cb8659548ba789845787f0796f3d7e6b041a194125ca254dca60d8377a70983aa3ec	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6C22C811-3F90-11EF-932D-5E6560CBCC6E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5033475b9dd3da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000009c00596481589e655a8827d43fcedf7631032df5f14194351a7ccf42ab664fa2000000000e8000000002000020000000d2861ec608ae5dd7029f927eabd981774ecf41a3bb09a81ef14332db71bf0df390000000db4af07ef19bb4a6680407b0e81b7fec6257abd05739c4f516ed43a503f2cf587867faeea3f3c80f58767789bcd9b4f86fffeea4382df768ec3683bcb25a8dab0124067cac736887b292a1df50fad2247ff6d75f6750f19e347166e90a19550931d25770a54505a653500314511ca3e67354816b62d6ddff6912f46a4bf225a5f905f809fae7bcde971d19fdc627d515400000009c5a8467341653a0adc7a50cd690bd598e68ec130fe8baea55f461bc9bb9c0ace84010fed8bf1b5d6c54fb1d82c84ea52bd3460d394092d284518833fdaded3d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2776	2276	iexplore.exe	31
PID 2276 wrote to memory of 2776	2276	iexplore.exe	31
PID 2276 wrote to memory of 2776	2276	iexplore.exe	31
PID 2276 wrote to memory of 2776	2276	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\397ac5e45fed842bd346c04d5d4b92eb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2776

Network

DNS

www.e-marketing.info.pl

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.e-marketing.info.pl

IN A

Response
DNS

server.livechatinc.net

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

server.livechatinc.net

IN A

Response

server.livechatinc.net

IN A

108.168.142.216
GET

http://pagead2.googlesyndication.com/pagead/show_ads.js

IEXPLORE.EXE

Remote address:

216.58.201.98:80

Request

GET /pagead/show_ads.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: pagead2.googlesyndication.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Timing-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Vary: Accept-Encoding
Date: Thu, 11 Jul 2024 14:18:24 GMT
Expires: Thu, 11 Jul 2024 14:18:24 GMT
Cache-Control: private, max-age=3600
Content-Type: text/javascript; charset=UTF-8
ETag: 2477595516990879164
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 16011
X-XSS-Protection: 0
DNS

c.pki.goog

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

c.pki.goog

IN A

Response

c.pki.goog

IN CNAME

pki-goog.l.google.com

pki-goog.l.google.com

IN A

172.217.169.67
GET

http://c.pki.goog/r/r1.crl

IEXPLORE.EXE

Remote address:

172.217.169.67:80

Request

GET /r/r1.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: c.pki.goog

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
Content-Length: 854
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Thu, 11 Jul 2024 13:30:49 GMT
Expires: Thu, 11 Jul 2024 14:20:49 GMT
Cache-Control: public, max-age=3000
Last-Modified: Wed, 01 Nov 2023 07:48:00 GMT
Content-Type: application/pkix-crl
Vary: Accept-Encoding
Age: 2855
DNS

o.pki.goog

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

o.pki.goog

IN A

Response

o.pki.goog

IN CNAME

pki-goog.l.google.com

pki-goog.l.google.com

IN A

172.217.169.67
GET

http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEF8VuaW0eNbgEvZC4RcercE%3D

IEXPLORE.EXE

Remote address:

172.217.169.67:80

Request

GET /wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEF8VuaW0eNbgEvZC4RcercE%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: o.pki.goog

Response

HTTP/1.1 200 OK

Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Thu, 11 Jul 2024 14:12:10 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 374
GET

http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEAfIiDuVFcZTCU3o6tNoEGU%3D

IEXPLORE.EXE

Remote address:

172.217.169.67:80

Request

GET /wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEAfIiDuVFcZTCU3o6tNoEGU%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: o.pki.goog

Response

HTTP/1.1 200 OK

Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Thu, 11 Jul 2024 13:37:56 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 2470
DNS

tpc.googlesyndication.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

tpc.googlesyndication.com

IN A

Response

tpc.googlesyndication.com

IN A

142.250.178.1
GET

https://tpc.googlesyndication.com/sodar/sodar2.js

IEXPLORE.EXE

Remote address:

142.250.178.1:443

Request

GET /sodar/sodar2.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: tpc.googlesyndication.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="adspam-signals-scs"
Report-To: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
Date: Thu, 11 Jul 2024 14:19:06 GMT
Expires: Thu, 11 Jul 2024 14:19:06 GMT
Cache-Control: private, max-age=3000
ETag: "1637097310169751"
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
GET

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

IEXPLORE.EXE

Remote address:

142.250.178.1:443

Request

GET /sodar/sodar2/225/runner.html HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: tpc.googlesyndication.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Encoding: gzip
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="adspam-signals-scs"
Report-To: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
Content-Length: 5046
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Mon, 08 Jul 2024 10:08:22 GMT
Expires: Tue, 08 Jul 2025 10:08:22 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Mon, 21 Jun 2021 20:47:05 GMT
Content-Type: text/html
Vary: Accept-Encoding
Age: 274244
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
DNS

o.pki.goog

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

o.pki.goog

IN A

Response

o.pki.goog

IN CNAME

pki-goog.l.google.com

pki-goog.l.google.com

IN A

172.217.169.67
GET

http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEAfIiDuVFcZTCU3o6tNoEGU%3D

IEXPLORE.EXE

Remote address:

172.217.169.67:80

Request

GET /wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEAfIiDuVFcZTCU3o6tNoEGU%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: o.pki.goog

Response

HTTP/1.1 200 OK

Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Thu, 11 Jul 2024 13:37:56 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 2470

216.58.201.98:80

http://pagead2.googlesyndication.com/pagead/show_ads.js

http

IEXPLORE.EXE

876 B
17.2kB
13
16

HTTP Request

GET http://pagead2.googlesyndication.com/pagead/show_ads.js

HTTP Response

200
216.58.201.98:80

pagead2.googlesyndication.com

IEXPLORE.EXE

190 B
92 B
4
2
108.168.142.216:80

server.livechatinc.net

IEXPLORE.EXE

152 B
3
108.168.142.216:80

server.livechatinc.net

IEXPLORE.EXE

152 B
3
172.217.169.67:80

http://c.pki.goog/r/r1.crl

http

IEXPLORE.EXE

348 B
1.7kB
5
4

HTTP Request

GET http://c.pki.goog/r/r1.crl

HTTP Response

200
172.217.169.67:80

http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEAfIiDuVFcZTCU3o6tNoEGU%3D

http

IEXPLORE.EXE

842 B
3.1kB
8
6

HTTP Request

GET http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEF8VuaW0eNbgEvZC4RcercE%3D

HTTP Response

200

HTTP Request

GET http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEAfIiDuVFcZTCU3o6tNoEGU%3D

HTTP Response

200
108.168.142.216:80

server.livechatinc.net

IEXPLORE.EXE

152 B
3
108.168.142.216:80

server.livechatinc.net

IEXPLORE.EXE

152 B
3
142.250.178.1:443

tpc.googlesyndication.com

tls

IEXPLORE.EXE

710 B
4.5kB
9
8
142.250.178.1:443

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

tls, http

IEXPLORE.EXE

1.6kB
18.2kB
16
21

HTTP Request

GET https://tpc.googlesyndication.com/sodar/sodar2.js

HTTP Response

200

HTTP Request

GET https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

HTTP Response

200
172.217.169.67:80

http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEAfIiDuVFcZTCU3o6tNoEGU%3D

http

IEXPLORE.EXE

470 B
1.6kB
5
4

HTTP Request

GET http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEAfIiDuVFcZTCU3o6tNoEGU%3D

HTTP Response

200
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

747 B
7.7kB
9
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

747 B
7.7kB
9
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

831 B
7.8kB
10
13

8.8.8.8:53

www.e-marketing.info.pl

dns

IEXPLORE.EXE

69 B
126 B
1
1

DNS Request

www.e-marketing.info.pl
8.8.8.8:53

server.livechatinc.net

dns

IEXPLORE.EXE

68 B
84 B
1
1

DNS Request

server.livechatinc.net

DNS Response

108.168.142.216
8.8.8.8:53

c.pki.goog

dns

IEXPLORE.EXE

56 B
107 B
1
1

DNS Request

c.pki.goog

DNS Response

172.217.169.67
8.8.8.8:53

o.pki.goog

dns

IEXPLORE.EXE

56 B
107 B
1
1

DNS Request

o.pki.goog

DNS Response

172.217.169.67
8.8.8.8:53

tpc.googlesyndication.com

dns

IEXPLORE.EXE

71 B
87 B
1
1

DNS Request

tpc.googlesyndication.com

DNS Response

142.250.178.1
8.8.8.8:53

o.pki.goog

dns

IEXPLORE.EXE

56 B
107 B
1
1

DNS Request

o.pki.goog

DNS Response

172.217.169.67

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34e1f6cb5f8f3d2226e124f0c8d186f0

SHA1
88ceec3fae7712ac82c52786b24c99da5ccc550f

SHA256
bf830a276be57198a4c6e0f4e011eaf1218411fc1f0bde4cc77f6625a8888a20

SHA512
1ae3539c9545b3a0be6b32eb2e4bf18d33d6a3d89a1713243e989e0be36fdebcbe9b68fb8c22986d75ce0cca83e47c7d9181362fd35c24974c95c66ce3598cb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d589e7b863409539f9c7b6d626a23428

SHA1
06630b96468519a1ef4522bb39f5fff0bed68b67

SHA256
f64349f9ff38c340b9ad5e0e7afb66d840c0686ffde2de9ed067b9615005fb93

SHA512
e2b57da74f60227380493ef2d941a28bf0b09bc2da400a6385424f0e69a5a89ad191d60f8bc144c1d304d18d75829655a74e083f5e7b3aeb9b8f22dc34ff7374

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebfbe4fd1cbd500be03b4292a113be91

SHA1
194e1a6cb4c5e235b916f90a3f9678b35ae1efd2

SHA256
8d5d7aa0514146d7a18dacbb1e15bff8f6930e15b5d97435d48c305352a9a836

SHA512
2f6dbf6f37cb0456967158d21611f9d6378b93f1ba2e25fa383fb3ec04b180bc9a4b4861f24cf9eb583fe74575b8d51cb9cbe1f6013f418014f96a237b892e36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78ad0824f4197b346fee2d3e1141973a

SHA1
c30d6ac87f346f9c0dc55257121002a183451b28

SHA256
3536afccfd10ea5cc7327f57c79ceb584274b7a37d29f9737ed6cdcfc9bdfb77

SHA512
dfc6ae92f060e70135201ff3247dee3227b8b91cf577b9d1f48e7c90526c1634d22e89e38c7e389c2874b8e3862851f989b6351e7a7abe7ff33cb486e1550f51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0b2c18fb7ab97969557894696aa8471

SHA1
8ed589d86edacd35b45123314147ea3141e8de54

SHA256
3ee7f9040f06b26710e309879fe46496a38960421c3646a6ef9a39a5146c6974

SHA512
815913e47b045b1623c279580600c44ae7e2ec347b5f82ffcd1caf096f290e3d395c784561d65df7bc763dbc3ec55aa2197ce60e7c21fc1c46b182b603ffdd82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a582fdb8187fc8b9ef46ecb45c9e997

SHA1
d2c61f97219da17827e12f6a59d6fd7ecbc0e864

SHA256
5342ec52cf4cc6a8228e75bc56c496e5975035ddd923fffdcbcddf4ee74df681

SHA512
cc6c526923d425cf218809e2126798dcd23482d2b753ccde1a1d1f8d378ff711fa3451e79261af1686cec35deb9910988646747b4c1a96f69fc8ccbb58410a28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4da9bb8e30d9115a356c1320a93e0f80

SHA1
03428a639d8ae531c49140db5f5abfe83e44ab6d

SHA256
85adffd1419b7c9e1d1e17e98130a0e2db52291f443d32c48531f09f946689b1

SHA512
693558e727be5310f2c5da603050c87d772997dd38835cf19c1c39a8d6e991876c59aa57ceb737edfefedd2344150237fb57d3c040bef3a633ed92ab4581dab8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7aa761145dcd8d1cc0399048fbbee7e3

SHA1
141cfbfc0a9e93d276b0b4f4fd80e4d04a3714d8

SHA256
f1d87eced600d42ad887ef19620560f443092de25837f546ae1c54cff54eb7de

SHA512
2707cc86a3b98997a60bef798ac1f5834268e969e22dd06b914425c4815cafc2bb6439426ae5fe4d61c2549d8e335a2c7a99599ce4f7b2daaf8053f4961ca860

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6db8356f2cc734f820871ea4e5b42bb4

SHA1
27fcf3797f915eb3bc023c8956af2a15e05a699d

SHA256
2a4f800e031ddef3268d46e4864fb795e8e091b327a914180ee35b4d1f0edd6c

SHA512
dd83136d05507410ed2b43d6a6d3c0e5623ac6470fe7211f800122c52ec966a763ddbe25b6264b66ef394725128049657cfe22a651b411b55b3a7baad653fd9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc48857d38d14ca054af842b31298af1

SHA1
5409b3e9a36728102566fa10ffd4b0b362114264

SHA256
4af3371da53d8854dc995c149b42aaad7e811f0161f8c37a000a641194e6ba6f

SHA512
ea6df5db3e1b7402f58fc70a9029ebbe1a5cd81b757de9f991cb9c25ed47161c826dbe8f917d838e0ad1e6882ef7fe84bfd39379c3f3a08882015efe27c51771

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3533467b127ce4b4cd5f76a2d934c363

SHA1
c9bde246c238444afb656aa6ed474999f743e435

SHA256
a98534e0a17bc1770d63acf3e2c2e0b147bc44c6753da12d49ceb0a3d271fdd8

SHA512
39647da88db30e2375d66b7c20b5b7493a601b51277a9a54f994d98b470c2a59566c565d13b69dcdacebdf2d2b45282120cf8da4f3dad55f85b4d0d4bccb985f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dfdc79345c60f31343c674656fbf091

SHA1
bca3772410b9d9a125cb4fa3a577ab0d5dcb2494

SHA256
8069026723cdb852829fcb68918c483fb32663156977e4f0c5f9a73cb0014dcd

SHA512
f76e3f1a3a703b2d44021799e5ad93017b0d0a6e2765c14b58f1e127664f90394c771acf7dbc71b068f235a6cec0c2c64fd53c3f7ac26ecb221cfbfb3a8223cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
299382ca6f52c88a8dcd330a3c610f5a

SHA1
d605f7a9e8b0719c0298752ddd9563d8224078b9

SHA256
d94dd174150722055bd88fdeb48d4b53ad4a574945bd0954907bee717cad9c53

SHA512
0917d79f93d42c4a69f82c8cc27e5def0a2e4216ac05b67fb5d71de595e65f114dca65cc276a2d750692533510e49a8a9269f51b188a07c61943939e1487c3be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edfe21e2d1a81dee264853e6bb382bf4

SHA1
05c30a266caeb6249970d5351c8ef499f65538a7

SHA256
7b78e369c0ed5f2b26a63a41d14a1689257574522633126a670bc289cbfc7d79

SHA512
7f1419024f16e70a8df3fdc01a859a4a3477207ae6896698d7bf2d1460ba9a48fb898cc66c2f078900e6ae40cda33184faab9512f1576bba9c150600b0113689

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9770d7dbc0ac7b274f2c4790a9aa9dda

SHA1
791eb2ecf122a707b13c9dc84aad02f5026e7239

SHA256
f1b62bcd40a7f55072c165c95da2cbf3b43c6367c659542c5913102c3e6b3dbc

SHA512
53b4fff8f079fd27e9bc2e74f3bea37aafbdfa299eb493d1e6fac4ad03eb00a63629a0fc6c1ef383f9421378b5efe1bc961accfb7fb1583dba9fd7a5a4454aec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ebe2075030171df6e4c10b67e62c504

SHA1
6babbb986f30a1fb10170ebbc1f8d971daa43edc

SHA256
4cbf410f6e51138f58db7030e8b73ce79609630cc6c43f984d12eab81761e679

SHA512
64c3e71cb89f77bc012410ee442ddf1b9c99837d9f43d4c3df2f220ba985c07e0d72c7f08c94d00694c6294896471f8e0eeb44a255c9adef514938aa57a98242

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79f1491eaf7cf5966e031e3959435657

SHA1
b589c9727a18b97723fd577cba2ccab8e5616167

SHA256
9e3f7e0d3bcd5cff16cd282cba8f120d2c0cb8b134e05075d7504fe91de9154a

SHA512
333fe6a499def276129bf94857059fbcc47fcf1cbf7a3926c2f0406f1eaf0795d3af77aa96bab165172000d7b4b39e06104d83c57dfa6ce67579ad2be7c36f8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4221c44fe3d0fb281bbf670ec32a3920

SHA1
d2681d7baf0935d0a73e57a5023d8724b8f66713

SHA256
85b10023710b6b1b8c1bd3f1a48c60c9428baf0eb71fe858087d3486ade132c0

SHA512
1ae1bed3aaf529ba408bcc96056e3591ed4ac07186b72d2b11428cd70f8023c2877bdb44bb405b5fe22109e6df1a4a99aa34e214d3b1adc48c14ebc9f21f052a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
febfcbba1ea4e9e45bfab067b7c6426d

SHA1
5440d12adbfe42f67bccc1a8cd347ceeb62094a1

SHA256
d69cada1db17894081492f98371c09d055d3baeb45334f371bacbc5b31511567

SHA512
88f909b91918222f491242778f8cc79ac3f2d75b207a5545905d82f33a9d6a146fa1ac20715d184decd99a93da5d6ffdf53f4613d717672e03bbf8ac72a5e21e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c5705b76b4eff5a0e79cd42f89dff97

SHA1
950c517f83cdebd6591bb3ca84a975042d07ba23

SHA256
8263e7a6fdf29ca8c3178940a392ba3c723a6bac87c14f3d6a6accb7f7453dd7

SHA512
095517698f2d9ba230cfe814af4bf6caa98f8a0820887967b8f7a7e3515e369d52cc72204e65b42903bcfbcff29265702f38db0eeb9123154a35d279efd148c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
263040ef83e1403d1ae63df771b729a2

SHA1
4c58f4ca584731c0f49f80dc22744adbb2a67f21

SHA256
150156995c341391575337e937059850daf6e2d06071173d973169ae6104d395

SHA512
8c30060ea5e383d4f1c6bc62415fd0a431813fe79b751a5e3c8d9a9cd3d3610f311c8ee561f2edfb7c9c9882e47eda82d6f2830e162879b9ed48789f23282284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5J67VDZD\f[1].txt

Filesize
40KB

MD5
f951df76605d85885456d04136cec221

SHA1
55db353333292943a6fbe6e448dabf8a2668d117

SHA256
83fcf8be13dbd064499cad20cc63fcf059687526e11e27bbe0cfd4a17e06bb8f

SHA512
0997fc12fef60e682daaec1526671725f3cfc62d8e10c5c3fa860e1a275d83244d403c16aace45cef7d8147401e6a015f1b0c0e5c91038e4e2ec5d059b65cae3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAF24.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAF26.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.