489a542cb273fb3178144fb3ede223461da2ff7f9d5ac60f46d0df5120c4c766

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 18:09 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

daf037f10c23ae1a01178b0d54f0587a_JaffaCakes118.html
Size

28KB
MD5

daf037f10c23ae1a01178b0d54f0587a
SHA1

47026f96532ac68d1f986785ab8db12aaa3a33df
SHA256

489a542cb273fb3178144fb3ede223461da2ff7f9d5ac60f46d0df5120c4c766
SHA512

5374cebbffa4998ee98c5249ed41d19f868aab3f9900b5b8cb058825941451ec58939365aaa533ae432251e3636ec19381a4fd829ccbf1c33c2e1765bdd9dc8a
SSDEEP

768:Zcd9QZBC7mOdMgLpC5I9nC4KwYwxw8QHPd:gQZBCCOdT0IxCxwYwxw8QHPd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F058FC41-7068-11EF-AD58-7ED3796B1EC0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432240017"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000837274dbe9c1d3ce89a4be904ba930bcb3eb17a48f6a80ade8dc6e27f62af690000000000e8000000002000020000000b3a50293b9a96d2c483d9500e087320c8d0827a96b679cf4457fbd0cac1784992000000008188216bfc24c7e948b657c4ac9a1ec664a4f30ad5409dea9da02dc7e99275240000000623f26395d047004100146775a63acacb528b4ff9eb5d4e473b46dcac1dcacd42c7325747a4e45dd890cdd9251938b52b14173335370e14b3f565fb49d604aca	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000005a09725eba8705aefc4915597b47cf5998c02748619789095e7dc11cbce11918000000000e8000000002000020000000d1e9b27276dfba90f4ae89df08eb2fc177e065589266a8067b46543a87bb2be39000000030e8842613b04c4d89c247e9ec2b93eda0065270576249ccf01d7cbf7798eeec497d7be069c1c2d065b8732f9f232806f8620b13b9c33451ffbd62cf714c8147ff8901dedeef505ddec218c878a6513f938b2bfacef41cb3e3d0f58fd918c71ec7ef475338610755b7b20e754fcbe1823960bccef373e48b9f05204357a9d752015efea5df531029477a80cafd41d09340000000f347c44c45d4a08c14fe6ac29ce3caa18a13e36c2e41544a6c8a443b60680b93e6aa438af59b9318d4de21df5f16945c81667e8931c448aecc1af815f056d9df	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ee49ea7504db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2816	2148	iexplore.exe	31
PID 2148 wrote to memory of 2816	2148	iexplore.exe	31
PID 2148 wrote to memory of 2816	2148	iexplore.exe	31
PID 2148 wrote to memory of 2816	2148	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\daf037f10c23ae1a01178b0d54f0587a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2816

Network

DNS

web.icq.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

web.icq.com

IN A

Response

web.icq.com

IN CNAME

www.icq.com

www.icq.com

IN CNAME

www.ovip.icq.com

www.ovip.icq.com

IN A

5.61.236.229
DNS

web.icq.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

web.icq.com

IN A
DNS

double.boublebarelled.ws

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

double.boublebarelled.ws

IN A

Response

double.boublebarelled.ws

IN A

64.70.19.203
GET

http://double.boublebarelled.ws/FrMal

IEXPLORE.EXE

Remote address:

64.70.19.203:80

Request

GET /FrMal HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: double.boublebarelled.ws
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: openresty
Date: Wed, 11 Sep 2024 18:09:13 GMT
Content-Type: text/html; charset=ISO-8859-1
Content-Length: 577
Connection: keep-alive
Access-Control-Allow-Origin: *
GET

http://web.icq.com/whitepages/online?icq=203131854&img=5

IEXPLORE.EXE

Remote address:

5.61.236.229:80

Request

GET /whitepages/online?icq=203131854&img=5 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: web.icq.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Server: kittenx
Date: Wed, 11 Sep 2024 18:09:16 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://web.icq.com/whitepages/online?icq=203131854&img=5
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
DNS

www.website.ws

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.website.ws

IN A

Response

www.website.ws

IN CNAME

website.ws

website.ws

IN A

64.70.19.170
GET

https://web.icq.com/whitepages/online?icq=203131854&img=5

IEXPLORE.EXE

Remote address:

5.61.236.229:443

Request

GET /whitepages/online?icq=203131854&img=5 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: web.icq.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Server: kittenx
Date: Wed, 11 Sep 2024 18:09:28 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://icq.com/
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
DNS

icq.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

icq.com

IN A

Response

icq.com

IN A

5.61.236.229
GET

https://icq.com/

IEXPLORE.EXE

Remote address:

5.61.236.229:443

Request

GET / HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: icq.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Moved Temporarily

Server: kittenx
Date: Wed, 11 Sep 2024 18:09:29 GMT
Content-Type: text/html
Content-Length: 154
Connection: keep-alive
Location: https://icq.com/en
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
GET

https://icq.com/en

IEXPLORE.EXE

Remote address:

5.61.236.229:443

Request

GET /en HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: icq.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Moved Temporarily

Server: kittenx
Date: Wed, 11 Sep 2024 18:09:29 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://icq.com/desktop/en#windows
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy-Report-Only: default-src 'none'; script-src icq.com c.icq.com cicq.org 1l-hit.mail.ru www.google-analytics.com buddyicon.foto.mail.ru www.googletagmanager.com top-fwz1.mail.ru 'sha256-DKOsdd00IXAHc7qK64HiC18YrB2K4SfiH8Sl6A9aFyg=' 'sha256-u4WiMVZhYDdCrFwB8Zn3gLba1EI3pqIlFYWFZfXJl2I=' 'sha256-ynzJCJTMBeZF6kbmzoI2rC+vDRozRAHxsPfAruxve88=' 'sha256-j51JRkq0bwz97Hd/1wJQsIy6/aX9cz16Xyp+M8FshTA=' 'self'; style-src c.icq.com icq.com cicq.org 'self' 'unsafe-inline'; img-src data: icq.com c.icq.com cicq.org api.icq.net www.google-analytics.com buddyicon.foto.mail.ru files.icq.com files.imgsmail.ru u.icq.net u.myteam.vmailru.net ub.icq.net ub.myteam.vmailru.net swa.icq.com stats.g.doubleclick.net 'self'; media-src data: icq.com c.icq.com cicq.org api.icq.net www.google-analytics.com files.icq.com api.icq.net files.imgsmail.ru u.icq.net u.myteam.vmailru.net ub.icq.net ub.myteam.vmailru.net 'self'; font-src icq.com c.icq.com cicq.org 'self'; connect-src privacy.icq.com icq.com top-fwz1.mail.ru 'self'; report-uri /system/error
Content-Security-Policy: upgrade-insecure-requests
X-XSS-Protection: 1; mode=block; report=https://cspreport.mail.ru/xxssprotection
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
GET

https://icq.com/desktop/en

IEXPLORE.EXE

Remote address:

5.61.236.229:443

Request

GET /desktop/en HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: icq.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: kittenx
Date: Wed, 11 Sep 2024 18:09:31 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy-Report-Only: default-src 'none'; script-src icq.com c.icq.com cicq.org 1l-hit.mail.ru www.google-analytics.com buddyicon.foto.mail.ru www.googletagmanager.com top-fwz1.mail.ru 'sha256-DKOsdd00IXAHc7qK64HiC18YrB2K4SfiH8Sl6A9aFyg=' 'sha256-u4WiMVZhYDdCrFwB8Zn3gLba1EI3pqIlFYWFZfXJl2I=' 'sha256-ynzJCJTMBeZF6kbmzoI2rC+vDRozRAHxsPfAruxve88=' 'sha256-j51JRkq0bwz97Hd/1wJQsIy6/aX9cz16Xyp+M8FshTA=' 'self'; style-src c.icq.com icq.com cicq.org 'self' 'unsafe-inline'; img-src data: icq.com c.icq.com cicq.org api.icq.net www.google-analytics.com buddyicon.foto.mail.ru files.icq.com files.imgsmail.ru u.icq.net u.myteam.vmailru.net ub.icq.net ub.myteam.vmailru.net swa.icq.com stats.g.doubleclick.net 'self'; media-src data: icq.com c.icq.com cicq.org api.icq.net www.google-analytics.com files.icq.com api.icq.net files.imgsmail.ru u.icq.net u.myteam.vmailru.net ub.icq.net ub.myteam.vmailru.net 'self'; font-src icq.com c.icq.com cicq.org 'self'; connect-src privacy.icq.com icq.com top-fwz1.mail.ru 'self'; report-uri /system/error
Content-Security-Policy: upgrade-insecure-requests
X-XSS-Protection: 1; mode=block; report=https://cspreport.mail.ru/xxssprotection
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip

64.70.19.203:80

double.boublebarelled.ws

IEXPLORE.EXE

382 B
44 B
8
1
64.70.19.203:80

http://double.boublebarelled.ws/FrMal

http

IEXPLORE.EXE

632 B
942 B
8
4

HTTP Request

GET http://double.boublebarelled.ws/FrMal

HTTP Response

200
5.61.236.229:80

web.icq.com

IEXPLORE.EXE

242 B
124 B
5
3
5.61.236.229:80

http://web.icq.com/whitepages/online?icq=203131854&img=5

http

IEXPLORE.EXE

624 B
682 B
7
5

HTTP Request

GET http://web.icq.com/whitepages/online?icq=203131854&img=5

HTTP Response

301
64.70.19.170:443

www.website.ws

tls

IEXPLORE.EXE

723 B
175 B
12
4
64.70.19.170:443

www.website.ws

tls

IEXPLORE.EXE

723 B
175 B
12
4
5.61.236.229:443

https://web.icq.com/whitepages/online?icq=203131854&img=5

tls, http

IEXPLORE.EXE

1.9kB
5.5kB
16
13

HTTP Request

GET https://web.icq.com/whitepages/online?icq=203131854&img=5

HTTP Response

301
64.70.19.170:443

www.website.ws

tls

IEXPLORE.EXE

668 B
175 B
9
4
64.70.19.170:443

www.website.ws

tls

IEXPLORE.EXE

668 B
175 B
9
4
5.61.236.229:443

https://icq.com/desktop/en

tls, http

IEXPLORE.EXE

2.5kB
20.1kB
19
26

HTTP Request

GET https://icq.com/

HTTP Response

302

HTTP Request

GET https://icq.com/en

HTTP Response

302

HTTP Request

GET https://icq.com/desktop/en

HTTP Response

200
5.61.236.229:443

icq.com

tls

IEXPLORE.EXE

778 B
4.9kB
10
11
64.70.19.170:443

www.website.ws

IEXPLORE.EXE

152 B
3
64.70.19.170:443

www.website.ws

tls

IEXPLORE.EXE

664 B
171 B
13
4
64.70.19.170:443

www.website.ws

IEXPLORE.EXE

190 B
88 B
4
2
64.70.19.170:443

www.website.ws

tls

IEXPLORE.EXE

334 B
215 B
6
5
64.70.19.170:443

www.website.ws

IEXPLORE.EXE

190 B
88 B
4
2
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

793 B
7.8kB
10
13
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

747 B
7.8kB
9
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

1.2kB
12.1kB
14
17

8.8.8.8:53

web.icq.com

dns

IEXPLORE.EXE

114 B
114 B
2
1

DNS Request

web.icq.com

DNS Request

web.icq.com

DNS Response

5.61.236.229
8.8.8.8:53

double.boublebarelled.ws

dns

IEXPLORE.EXE

70 B
86 B
1
1

DNS Request

double.boublebarelled.ws

DNS Response

64.70.19.203
8.8.8.8:53

www.website.ws

dns

IEXPLORE.EXE

60 B
90 B
1
1

DNS Request

www.website.ws

DNS Response

64.70.19.170
8.8.8.8:53

icq.com

dns

IEXPLORE.EXE

53 B
69 B
1
1

DNS Request

icq.com

DNS Response

5.61.236.229

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0bf341039a2815ccfeb059a59e04a45

SHA1
ffb443739823da7668438a138ebab5ea3e9039ce

SHA256
bd5b9f5a2d1e7f23b089433ebc8b7c09590c42af5ce4393c84b78400ea1de51f

SHA512
a9fc8877ebad54ee4c8eb108c2c62e609091b2f180c9185685c2b7613c5b9c4687f4e83111179debfcdd47934780b359c3de12f3f6e14ea0ad13e23136d1efba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9da9013cd1c43e627d33e8290363880

SHA1
c89613f3100bc10102efd647bea871c530f1da27

SHA256
f6227ab4d415d6f4397ea1085321152223c6f8375c999837e47e3c16a9954cca

SHA512
3f1f36d48300c9427623c7c10d73f7161eb187a99b05ea0ccdabe631a66bf16940529cec314fcdc4a7dabc5234938bbdfb9159a11f5a22af5af5f64f13286b93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c588a94ef33e63f96d7a669e424e4b8e

SHA1
e902fa4606fe55688fe5a27d0de79c754addae97

SHA256
a7992a7e900d2848079545735d45ab8b2b713a30d77e7fef59a9a58244c4e3ee

SHA512
fad8128658c0292eec000ee3a5b3a269aa7712ca9b049089e4d5f05b2d986751fc84ee5d1a74241979a0efde18f254541152240f5c594f43e6e3a7f30c956fe4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e9e606e583565a5900bd51451813e14

SHA1
acac1bcb291c2fff822c5beb41f715b19ab80ecc

SHA256
a30ce3af86d1f263f9055e2cd5f99af19422c0eedce636624b8bde4d49d42e74

SHA512
a9dc770124b0abb06f713274252abbafab273ac26edde8226dfe38e1d03ae16d0af959c8c534a8423d83c10fc904f5dffabe74c23aa5cdab5be026a565dc5e6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dce52a7571a54e4e3c7876ff682a15db

SHA1
46fd98ae3b654b3b75b551e84b5090b52294d279

SHA256
dfbe933a262d883151d5ab174af9657643cab665c8340df037c949e0d1ecf6ef

SHA512
d65e6fed8fa609d0b0f791198eeef7c07190671d5564e40ef002fba0e2caeeba4be7f0846e5c7c306d2417c45b533789df6bdba6b037a86665feaacb7664f1fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e33f8a560310c718e1f2c4a529353b43

SHA1
430c12e40f7ac7555b908ad1440ccd14445801f4

SHA256
f5f33d021e6fd99379cdac246a78fe466daeef8045fd3b2689f92677d1fad190

SHA512
8b94c0f5a771036ef4466d292a914bd391e84f3bde011cb6c3c5ca23f7a0cd79b9365ce70f55e5e2652b55a5a99230f748dc77631bff9810e9203574f1a2ba2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16ca2701a5e78ddbba7993b717dd44f8

SHA1
488379f6bc6eb25cb8708361607f7d8edba79253

SHA256
b26218bcbe2201f7ba88a86a434b0ac17dbe1509aff7289cc9b910806300142f

SHA512
afb63bff01a8da817b9fcc970965b0d636dc3a2da9b576296c66a36375b699b799d2bd91170cb4c3ebdb99097068fa50f12ab32fb4f7e6d520df748893ee5b90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f0efc953d099b5f55194975db30d202

SHA1
29f8e964f565b796e45d9d787852d4775cbc93fb

SHA256
2fc21a93651e2435935582c928c12ad3d222e6ee8d5cd8612fe177a971fe79d6

SHA512
0a87badae619ae9c09b3ed424faefc3ba40f9d7021e2b4bedd357b7b2e8e1e4f74774c434e74d17f7ea8dc2c64cdf55a88b4e09f5ce80880d630a628ae3bbb68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc8c5eec02331b69d4edc17ecc6467dd

SHA1
c83b3b6749e4bcf4cad6d1d506d3d57832f5ad3d

SHA256
04aa90a007b6dc4af70915ba9256e23cad7c735731e7d3b5c4f8f1b5a02f9628

SHA512
7adbbacb619d3feac6717c74cbcb9897ce675a90837852b2e1432d30b590382698439d709a63c491cea9d1428893852e66165a2dc0e39a4d89e675eb908f441c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bbcda4d1f0e77559b7ade9a2d27c565

SHA1
bedfdacbcd3a2e5ba15c347f1d7b9367bc750b80

SHA256
6856a1447ddf934454e2710faf5d2fc0d4095020d151c0624d9975ad3b895f91

SHA512
6abaa000be356244a157bad9db0cef3d3685d89746f0a18aa83af92f5fd9db549ba2caba0fe4270efd12b3776e8432c6b2a678b6979ae47a2156fa366e833bb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02c08a17c9298467519304816be2d16d

SHA1
3e48eb04b61d56969de5a1071280adf8891a6d8c

SHA256
ef2c3d3afac56283aa2c2195b50d8bc21187d9f76eba067a86d36775ff567d82

SHA512
7d22a3099edb1ec446a0f1203be26acb0761885d5dc6e35a7dad5f424c18e1c4653701ad4a53055422992bcca094610fad514c732b5b022e1864f3d0c9c9012d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd2702bfe042aace3034aa63a64a5c06

SHA1
933b020f44479c478b5afc332ee0ef1eeb4e1069

SHA256
a4b72fca7ab75c464d96297dc1159673ad99637a0b66ce9d55a7a69286398ac6

SHA512
a50cfb07805b7d7b422ed46927879eabfc69fdda03993ae33171bad74fde60b19f66bff3970f2c780d1aea8c4caf87f0607d559cd2b531a323fafbab1ba3b69b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b5df74d2757765bcffd05ee044ae71b

SHA1
f28bbf7340c5e7ac26ae4ea258797faf86ca5413

SHA256
62b5e432ca878943b8765db385731490100ddbf830ec92f3425c1d2ede5e0933

SHA512
887a7e47ab6e2ede78492e918280c9512b517c014750449cd4a5c183d4a96396f70db6b063391366fafad5ebfabc3c3cf0d4a2305e7a2b799aa29915131e4503

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aea546c53a7f9c581dbec86baa830e0b

SHA1
5d89acb9d1c8e164718c65f6a853aba092562779

SHA256
65db7431160177bd27de489550231bbd78d6e009cdf42f83eea7b7148db907be

SHA512
c96cd20473aaddbe09ee5eea7fb97f77bd68d71bbdd16e47ef0f884579fd75867a3ee181d91f8df5ecac78cf2c56a4d0e40ab7aa7003a814abd9547428238b48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
280731482e9b01e75b5f24434a5bc1f7

SHA1
f7c2e0096e5aa382866fc6b64af694bf6a458a2b

SHA256
b06c8e4219c5c9c428fc808c58ef8895a7167df6902f6eeaa42acf9574134ce1

SHA512
25100a90ce05cdc25a8325346c95d8a4c1c52fb1870afbcaa62ca0ed01d080d77e5400fae0f2113b54e1708c78842172a901d31699174f5dd0a7ed31742bc07e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08a2a752d0d1b9040af617f7bde51b08

SHA1
748a5e79d0a2bee2976609960f7b208d32d817b7

SHA256
91adc5c2adf1bac47b521396ef37d23c63e0cbd70cdf4307bac825164a4f1c53

SHA512
d60b55c5eaf20d1c9cdf3f23bec504abe79acad2bf0e376c169e42593151fb0fb25a1734dda110f613bf9981486e6857b798e74c7b274f2c6b9ba5b4c34feb67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ac80bdf299379bec1ebba408c4a2bb8

SHA1
08ecb00cf5178a6bfe42c91bf971b7682aed7f0c

SHA256
23ca416fde9fb1ae0ef83dac3a7d84e7fefb49e6f8e15657b1578cc29714d875

SHA512
09725448687546642cf57b32d7e16da51021d05470e41c6fc5990cbc3f403e224351fe2d4c56e5d4bb449ae1cb8bb100ec60fbf42cfec95acaaea8948d851699

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b7d0a289b23a8112f044800ed2d6694

SHA1
f2b81c77ab6e54dd3974f54ccd80635f000330a9

SHA256
cbbd513df1fe950485170f498e96853ebd625660bb2b58f105861cf307518bc2

SHA512
fb2975550ee55b485746612bda871e1e32eb3ecad05e9be26073118eae67ee6fffb87dcc0f9bdb147bb599d1eb3bfbc39edeb03d144c23aacc90130096d85cc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd147e69f9b78e46b8867d346daff31c

SHA1
68e275461632fa6fdfa43d1ec27f96c953f324cd

SHA256
5a63bf3313a916edda63e100b7fbbd974d58a54b329646044dab588f01578862

SHA512
202f4dd127f8d8eee8a833c2c95e438f633394b942273e87a28ef45116c331decdfdb7bb063d1a5b488911ff1c16300dbdc552d43b4addf8067d82fd2f708924

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31fc4419f566c47b1f5d9f9c50a25142

SHA1
fe73531a1ef82a0f76d117d1a1e96aafb29f33b1

SHA256
847787b15a6bd95cc4da0d5d52748f4623170681e1f86d3f5aa859c599b3117a

SHA512
4e5cc46f302c65e81279ab06e06b7933ce783b8da8ff592280436688530ac7f938f52c655c6225a58424f2cc159fa9521f66348a2a7ca53d89d69cdada239005

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEAFC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEAFE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.