52c6ab8c609ba75e893a4b584c4a0d284461886604888bd5f2ea28b650729675

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 16:45 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de8136bb749f47011133829206315aea_JaffaCakes118.html
Size

62KB
MD5

de8136bb749f47011133829206315aea
SHA1

54a645ab70652277a3cde92b06a24987c5611f0e
SHA256

52c6ab8c609ba75e893a4b584c4a0d284461886604888bd5f2ea28b650729675
SHA512

201fe68c9e1c6426c83808b3c2a7b4b35da11e863d8ef9ecfef73e83dd8bf6d8b503cfca37534db0ccff0f187ea35ce9b05855bd9bedda7bb9560105c99c0efe
SSDEEP

1536:92qcC9sTf4MAyLf0EHUMWPacmPBPnqud8+e1EWYYhdYOGXWT8Kh7bj3Gx5mqU:9WC98f4MzfzGPKyqKh7bj3Gx5mqU

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000008e2e7e20527931e1b59da5ae7117becfc494ca083deee85a8c5e4c20ca3f0291000000000e80000000020000200000000d42a11e7cbf8c7bbb3e104401058606f2236b974eff04499144fe24521d9b3d20000000887a68294b596e3c33115d6daa29c6246af6411e63c527d2a4bca63d22bb40b64000000041ecab507c437df4a8d5b40ff214d0075b818441e7f71535ef9a9269260522c47cef4da9f459bde784c6b2bf7a4229f61804a21eee23e5f847beea719562e139	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FA18B51-71EF-11EF-87E3-523A95B0E536} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0207c66fc05db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432407786"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000f2a553ff269e28fd831875b3bf2933fb35e84aba9c8cbfa37960c98fbc3414c2000000000e8000000002000020000000cf081bf539083146c0cea7a9031e08f507af3e39ea2828528162a807945104cf90000000cf3404a3127c43599869730810cd317c916141f83f9dcf83ba275a2a69bdb4063be784b131344a7ec98513deb6076f93f78d65d5bb3a0da3d0945e67f2357edd9c82300ef37a8d29bccab75198e9dbae4c9055487ed00f31a3ff76a938cf6cf0b5f45443dae3d2d3e85d2fe26585e45dc7cfa1b27e7bfe93fcac354f15e36de2a6a4b701f1139d1d5862e091bd02a66e4000000083464c0ccb08ed8c7574e567b5ca08b91bedf1edfc92f6fd6cf14d921c258bc27cd18ea9d2884e6c085826ede8dd97745662f7133ef5b762e3319659b64bd336	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1236	iexplore.exe
1236	iexplore.exe
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 2468	1236	iexplore.exe	30
PID 1236 wrote to memory of 2468	1236	iexplore.exe	30
PID 1236 wrote to memory of 2468	1236	iexplore.exe	30
PID 1236 wrote to memory of 2468	1236	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\de8136bb749f47011133829206315aea_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1236 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2468

Network

DNS

b-healthyaging.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

b-healthyaging.com

IN A

Response
DNS

c.pki.goog

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

c.pki.goog

IN A

Response

c.pki.goog

IN CNAME

pki-goog.l.google.com

pki-goog.l.google.com

IN A

142.250.179.227
DNS

c.pki.goog

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

c.pki.goog

IN A

Response

c.pki.goog

IN CNAME

pki-goog.l.google.com

pki-goog.l.google.com

IN A

142.250.179.227
GET

http://c.pki.goog/r/r1.crl

IEXPLORE.EXE

Remote address:

142.250.179.227:80

Request

GET /r/r1.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: c.pki.goog

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
Content-Length: 854
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Fri, 13 Sep 2024 16:37:43 GMT
Expires: Fri, 13 Sep 2024 17:27:43 GMT
Cache-Control: public, max-age=3000
Age: 461
Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
Content-Type: application/pkix-crl
Vary: Accept-Encoding
GET

http://c.pki.goog/r/r1.crl

IEXPLORE.EXE

Remote address:

142.250.179.227:80

Request

GET /r/r1.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: c.pki.goog

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
Content-Length: 854
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Fri, 13 Sep 2024 16:37:43 GMT
Expires: Fri, 13 Sep 2024 17:27:43 GMT
Cache-Control: public, max-age=3000
Age: 461
Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
Content-Type: application/pkix-crl
Vary: Accept-Encoding
DNS

o.pki.goog

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

o.pki.goog

IN A

Response

o.pki.goog

IN CNAME

pki-goog.l.google.com

pki-goog.l.google.com

IN A

142.250.179.227
DNS

o.pki.goog

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

o.pki.goog

IN A

Response

o.pki.goog

IN CNAME

pki-goog.l.google.com

pki-goog.l.google.com

IN A

142.250.179.227
GET

http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEGs31zQSL0RFCna%2BsoPon%2Bg%3D

IEXPLORE.EXE

Remote address:

142.250.179.227:80

Request

GET /wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEGs31zQSL0RFCna%2BsoPon%2Bg%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: o.pki.goog

Response

HTTP/1.1 200 OK

Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Fri, 13 Sep 2024 16:19:55 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 1532
GET

http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEGs31zQSL0RFCna%2BsoPon%2Bg%3D

IEXPLORE.EXE

Remote address:

142.250.179.227:80

Request

GET /wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEGs31zQSL0RFCna%2BsoPon%2Bg%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: o.pki.goog

Response

HTTP/1.1 200 OK

Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Fri, 13 Sep 2024 16:19:55 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 1529
DNS

strategictelemetry.net

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

strategictelemetry.net

IN A

Response

strategictelemetry.net

IN A

64.41.87.58
GET

http://strategictelemetry.net/js/jquery.min.php?c_utt=SWR2D2&c_utm=http%3A%2F%2Fstrategictelemetry.net%2Fjs%2Fjquery.min.php%3Fdefault_keyword%3D%25E0%25B9%2581%25E0%25B8%259A%25E0%25B8%259A%25E0%25B8%259B%25E0%25B8%25A3%25E0%25B8%25B0%25E0%25B9%2580%25E0%25B8%25A1%25E0%25B8%25B4%25E0%25B8%2599%25E0%25B8%2584%25E0%25B8%25A7%25E0%25B8%25B2%25E0%25B8%25A1%25E0%25B8%25AA%25E0%25B8%25B8%25E0%25B8%2582%2520%25E2%2580%2593%2520B-HEALTHYAGING%26se_referrer%3D%26source%3D

IEXPLORE.EXE

Remote address:

64.41.87.58:80

Request

GET /js/jquery.min.php?c_utt=SWR2D2&c_utm=http%3A%2F%2Fstrategictelemetry.net%2Fjs%2Fjquery.min.php%3Fdefault_keyword%3D%25E0%25B9%2581%25E0%25B8%259A%25E0%25B8%259A%25E0%25B8%259B%25E0%25B8%25A3%25E0%25B8%25B0%25E0%25B9%2580%25E0%25B8%25A1%25E0%25B8%25B4%25E0%25B8%2599%25E0%25B8%2584%25E0%25B8%25A7%25E0%25B8%25B2%25E0%25B8%25A1%25E0%25B8%25AA%25E0%25B8%25B8%25E0%25B8%2582%2520%25E2%2580%2593%2520B-HEALTHYAGING%26se_referrer%3D%26source%3D HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: strategictelemetry.net
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Fri, 13 Sep 2024 16:45:03 GMT
Content-Length: 1245

142.250.179.227:80

http://c.pki.goog/r/r1.crl

http

IEXPLORE.EXE

348 B
1.7kB
5
4

HTTP Request

GET http://c.pki.goog/r/r1.crl

HTTP Response

200
142.250.179.227:80

http://c.pki.goog/r/r1.crl

http

IEXPLORE.EXE

348 B
1.7kB
5
4

HTTP Request

GET http://c.pki.goog/r/r1.crl

HTTP Response

200
142.250.179.227:80

http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEGs31zQSL0RFCna%2BsoPon%2Bg%3D

http

IEXPLORE.EXE

566 B
884 B
7
4

HTTP Request

GET http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEGs31zQSL0RFCna%2BsoPon%2Bg%3D

HTTP Response

200
142.250.179.227:80

http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEGs31zQSL0RFCna%2BsoPon%2Bg%3D

http

IEXPLORE.EXE

520 B
1.6kB
6
4

HTTP Request

GET http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEGs31zQSL0RFCna%2BsoPon%2Bg%3D

HTTP Response

200
64.41.87.58:80

http://strategictelemetry.net/js/jquery.min.php?c_utt=SWR2D2&c_utm=http%3A%2F%2Fstrategictelemetry.net%2Fjs%2Fjquery.min.php%3Fdefault_keyword%3D%25E0%25B9%2581%25E0%25B8%259A%25E0%25B8%259A%25E0%25B8%259B%25E0%25B8%25A3%25E0%25B8%25B0%25E0%25B9%2580%25E0%25B8%25A1%25E0%25B8%25B4%25E0%25B8%2599%25E0%25B8%2584%25E0%25B8%25A7%25E0%25B8%25B2%25E0%25B8%25A1%25E0%25B8%25AA%25E0%25B8%25B8%25E0%25B8%2582%2520%25E2%2580%2593%2520B-HEALTHYAGING%26se_referrer%3D%26source%3D

http

IEXPLORE.EXE

967 B
1.5kB
6
3

HTTP Request

GET http://strategictelemetry.net/js/jquery.min.php?c_utt=SWR2D2&c_utm=http%3A%2F%2Fstrategictelemetry.net%2Fjs%2Fjquery.min.php%3Fdefault_keyword%3D%25E0%25B9%2581%25E0%25B8%259A%25E0%25B8%259A%25E0%25B8%259B%25E0%25B8%25A3%25E0%25B8%25B0%25E0%25B9%2580%25E0%25B8%25A1%25E0%25B8%25B4%25E0%25B8%2599%25E0%25B8%2584%25E0%25B8%25A7%25E0%25B8%25B2%25E0%25B8%25A1%25E0%25B8%25AA%25E0%25B8%25B8%25E0%25B8%2582%2520%25E2%2580%2593%2520B-HEALTHYAGING%26se_referrer%3D%26source%3D

HTTP Response

404
64.41.87.58:80

strategictelemetry.net

IEXPLORE.EXE

144 B
92 B
3
2
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

747 B
7.8kB
9
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

799 B
7.9kB
10
13
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

779 B
7.8kB
9
12

8.8.8.8:53

b-healthyaging.com

dns

IEXPLORE.EXE

64 B
137 B
1
1

DNS Request

b-healthyaging.com
8.8.8.8:53

c.pki.goog

dns

IEXPLORE.EXE

56 B
107 B
1
1

DNS Request

c.pki.goog

DNS Response

142.250.179.227
8.8.8.8:53

c.pki.goog

dns

IEXPLORE.EXE

56 B
107 B
1
1

DNS Request

c.pki.goog

DNS Response

142.250.179.227
8.8.8.8:53

o.pki.goog

dns

IEXPLORE.EXE

56 B
107 B
1
1

DNS Request

o.pki.goog

DNS Response

142.250.179.227
8.8.8.8:53

o.pki.goog

dns

IEXPLORE.EXE

56 B
107 B
1
1

DNS Request

o.pki.goog

DNS Response

142.250.179.227
8.8.8.8:53

strategictelemetry.net

dns

IEXPLORE.EXE

68 B
84 B
1
1

DNS Request

strategictelemetry.net

DNS Response

64.41.87.58

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffe197d4baafc739021971cdeef46033

SHA1
72fd719fe18dbff30513becd88070d7a61d206ec

SHA256
1b6445a8e2cc6551556898c469947e97429a5c00e6b60d997fdc5ad2f6141d35

SHA512
eaa5e966f43883f99aec101355a8f5586f60bc021b2feeaaa6fce061c7a97d38384b3e255b062d700421c6084adac91f8c2891b5ed39be73f8b3120c27ec4920

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd251de8f8ce0529db392be06ecac9d3

SHA1
16495cc5dfb9a6e3a48a2e3be4abf7578aa299e2

SHA256
76961ce3cb7d67a820c7cf66f60a420ee3a2c08abfdcbe52ae69537c7b6fcd1b

SHA512
f372e15639167e29a6d40c7f5b3c4d799385c9d5b66bafb292a668006a205f6a32e9b1a9cd538428d684f71b6d1dedd25975d3cf6cfa07f4fc12919cf7ecac68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc992c6d0a4853a5bec1de99102e2535

SHA1
a12786e345c9778026ccfa45c2bf72498459503b

SHA256
5ce8b28b037c7eaab2363bd79d893278610a142f53815c0e268f3ef8cf5c9fe5

SHA512
a493dc4bd85ad4bab414f90a65c4b145df4f1120a04ac541580fe0567a83ec1a561ccf29b63d99f6362f7285833f1adec74fa9655e28bd25b6bb4bb56c7d0b07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7bcb73560b98fc35ff152a0fa5f3c9d

SHA1
d936b3867027ab7ad0a91e0e2e82d8a970956d39

SHA256
15bb71c0b9fb6e32aab24053b892da0e864cff2d8e7fe13fa7eb995e78843706

SHA512
020078382301a902fabcb58512204191ff3b5635bf3c5113baa62bbf959c66f55bb37f637f60ed29fc9eba28839e396f0789dd88ab95182c62f8c2732663d477

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
759e0dcacda42c1f3a874e7f856bb0fa

SHA1
74207f7c8a12ea565d0570984692a695a9a0ccdc

SHA256
79859a981947dd101d57264a969bfcedb7688b3a8a47325c63c604e450c0e607

SHA512
80b81515c7934eee7eda63a4cc15505a635ac35ad8ebb2b8a8dde6eb76ce56d98281d503ae1d941139c192cf57ff77476d3c6283c14b046ff2df69fa537c9311

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59f39bbdd516b76f06b6b9f5b2493359

SHA1
d67d98623ae0e4b4547b3794a3151f7356e9bb40

SHA256
8f1c7b2c2683e6b113d83ac884f0a75fa5807c9a61be532708b9ad271eeefa39

SHA512
7c09cef4604bc69ae2c14f3083593e8a1191cf1e3b3ac6ef330cf96fe02140543aca225bf25cefefc2d683385b34c00b3221d77710c0cedfa400f4c0b8ca9222

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
028750f04d9c0954e3872ada80093d18

SHA1
d6cf60b30828ffe37eeb93c5aed8078818ee809d

SHA256
907939e42cf49ad651f76e0aab8fb815afff3c79d5a033e1e2b43e0bbcd37900

SHA512
7382f8abd120daf2421db6e81b3f25718fae3358c8f0bccc3e73606c459802ed989d7ec4aa53106e2c71eb108ba87dd98de9a85376841dd397a9d6924186541e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c250f11aa2609113ff35ff3348e25cc

SHA1
887f06ee51cf08532e62c7018794318a0cb93593

SHA256
77f461c873c7a2443bfa0772970c164cce3a93c1222a0e94d357fb2348b3d703

SHA512
4b6bd84a43fd321fd6401ee906f572beac8ddf43e858077bd055a4afc87659129eb8d5aecd151da0792206352d481ad1aabdd88d98d090c6df1015d5968171d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42490258cbed0763c1ffe00caead45e0

SHA1
4261aa4510d690ff30ce670ab54b0e1f8bf8b6e4

SHA256
a16e026092a8a3cedf105aff4c9be4d881a12ba663bfea90256d55dacfd1a8b1

SHA512
6050cfdf85831e7857393902d2ec35dbd3465fb562d09e5189acfe8b6a7cb1da4e5e5044a1a800b8c1c9e7a6fba3f43c6c3101f05aa005ed6917979554751689

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a1c2b03d47e3358a2201cfe4366e96d

SHA1
1c25ffdad8281ca25ab82d654d75274b94cadcd2

SHA256
2775ebf02407801422277f90403d1bfab27cf67064a9cbcc427f993d019f8001

SHA512
ed85e0b16bb731d5aab162eb06dc4c2ce29713cf8a97db2d78db2c85489b546ac9e8afe5f0a704cdbd7c14fab56a0371da7f49eeeed99cadef7f65d2a5912009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc75fb9612385b78f28fb66a632db88b

SHA1
ee3a3d542d225cd1890af262c94c1a246ce42804

SHA256
5f47ef13df87cc807fa69c552b626e9187ed3ea85b7d61dcf48c31ce50de67c8

SHA512
8d118807dc1eb4d562c32b10de3b68b23f53df428faad1fc371005102777ac8206e8ee467106e95e52ee1cf5f1b2365b438474aa425279edb054e1cd164a8277

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc4ca6cf442b2f48acbe72f05ab12f5e

SHA1
90c060162edcfe38c6d4aff0357440ce30428a6f

SHA256
dff7bce043af1c5a6dccd05affb18f3b4ef5de1a2aa547b9831aa258711095e1

SHA512
9a704945963dab830bb94c6d89cc87e8a7277a1c099a317e58e069912bd633701d6965bcc338553b7ee7e46287511e945f797e42d30bfb4641a09cf4e654116a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1a63ba743a59c161c6e52df730178eb

SHA1
03d61701a00eadd699dc4569b4d66490c160a2a4

SHA256
cf91a425f4430421e4f5b56a59c444af6bde4229fba4a7a0c1156f2c1efda14d

SHA512
28a50b679891e87a0944ed98d6b9429052c2ae0612e9c83287e2f94dca1093222d67ad79771371485d1268341ae086f217b88b89b4c5b16429306ff4b326e3d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9534e7160e324d89d1342a9dff81a014

SHA1
e925b7508c96fe60ad6e9bb46326c3867f3ebc5e

SHA256
7fdf07673f72f9a9f26b07ad5bc972da9f0b7fcdf621ce36e75cc6bf96cf2abf

SHA512
30622998931d5b1c5df52c3aa7cd9824821e8b05c9ad84278cfd14bcd120a8bcea51ddc50001d70f93277d7a64290fd4365015f8fee86b5438e98c68f3f4933e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df2585c12da20975f5deed440d451ac5

SHA1
2ea9674d7eb6130ac1dbaa759b58215043fb2e32

SHA256
54e1c29ecc6ce522797789698560c27e76f625c058c60ec819d913e2157591ab

SHA512
a459bf5a51a6781cc5b26e808829497edbf33ca52932063f601a4f152ecede6058cfff96f5b7cecff839ad5d0bcb5a81fc79295ae80fa2ad81ff5b25e2df33cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bc4d024d998dceed5e01c73e47e1105

SHA1
3072c78a03b6912e8ed1679ad0c3ccc279c03478

SHA256
e14241bd97902915455fefb98282eeda1c4203bdcc529f8adb53c103c1ed396c

SHA512
40a8b4da0e46506e83007d9f32fa1cac3103686a2ffb5c5c31bbc230b42de1b8e35a27afecdffc6dda06e52a8577d99c4fb4d462907f4e427a905966ef28c648

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22768c8247db576d1335b7d2fe8b1962

SHA1
fad17b89bb8a4a6c22b9ecc86f5a5903f714fe2c

SHA256
8c1cae6cc6eb2a18ab0e91ef9befea5cab51c82fff644ae11bbbad9cba83b954

SHA512
2bb81a2d390f7d18e1b462afc8bc18a2fe1df338ea30d6aa8ae69812fdf4008dcc0885df83373d27b1e5d2550af27d6182283d67ec339b67912308c06421e876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8b2f7ce1698c91b4b6bc4687f4bf69e

SHA1
a9bcc81126aa64391b8183ab13434513a698b77d

SHA256
05b61365855253491b8d028b6e0154ad133e2fbc26f9e171f0fd6ff4eb16ed22

SHA512
9b0938fe685f69cd51fee1bf84cd299de4400d568cc6782a60dd61b5f412137cb477e5d9baecb31275eb2e9e6a71eaad0b7d7feec7a1a2e24e8f9b39a597b721

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE80F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE812.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.