c1ad68481d07278aa9c6ecfe948fa39258c035add5ad3dad355b01957f066847

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 08:19 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef65aaaec51c8d69f57e54b5b8947344_JaffaCakes118.html
Size

31KB
MD5

ef65aaaec51c8d69f57e54b5b8947344
SHA1

1a16bf7beb19188adbf65f05e6b3d9738260541b
SHA256

c1ad68481d07278aa9c6ecfe948fa39258c035add5ad3dad355b01957f066847
SHA512

dcd41f5d58e0d5785e37f5cae3dd2e1ba2c9e86e8b203211abc85ad03543f99cbf394c9ed45c3af6f9f5f224c79617e955b6d869b9f2792e81c0bac7bc8e09c0
SSDEEP

192:VWCk3GDG7GSFGNGeWqGUpGtqhyvnb5nF2nQjxn5Q/UnQievNnonQOkEntManQTbx:ACk3GDG7GaGNG9qG8GtVQ/6WS2SQ/jZj

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000ca0d6e6da49116bd3b493a774aef36b630f657cdf6712a8710d434b9d185755d000000000e8000000002000020000000d4ad082a22361d41ad9e9a720b37c9580598d03d4abdeb9a13d31f2f8e6e754490000000f0a264817aa5903152f81cacc37c377c8c4fd71537fb432ee2715bd4b49024dd801bcecf82207716617d4a616606ff77103b36839a4dff16600e70603f9cfc06ac78a6efd26520ef973c184850c1ebea0cc7e2931bb8695f217b487e063bdf89ecbb5c4e6c15be773e41d27efff84e8d2b3396c25ea8588231397d6a758f721aeb8c5b83329b0405b0f78364374002e84000000037a2c868b1b562864742d9910f78333de5885c358da7f4e98f66a27db3fbff8b18817cb78379cd4f7f305eb0fb990930f043ad985708b9f37eb432e83791f9bc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000f95dd6fbc2bb44dd7da349b166d19c6bf3406a8d54296d01692b97b98b911177000000000e8000000002000020000000c2e7d53373dea7202ef958fe8c014ddbeabf400f963869d80ce257f23e9488e120000000b96a9b7498b517485f7fe6dbc198c6b8ef6cc2ab7f2a2a10b1df781bd0e62e934000000090577c085f7a95378223338a66a05c23f1d9809fac93dffaa98dfbdb0a296bb62cfc6dd94f8270aaeac62db79c1d7a771659dd95d980c599a367403e542feb37	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433068614"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 109d7400ff0bdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2BD31EF1-77F2-11EF-931E-C28ADB222BBA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2672	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2672	iexplore.exe
2672	iexplore.exe
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE
2120	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2120	2672	iexplore.exe	31
PID 2672 wrote to memory of 2120	2672	iexplore.exe	31
PID 2672 wrote to memory of 2120	2672	iexplore.exe	31
PID 2672 wrote to memory of 2120	2672	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ef65aaaec51c8d69f57e54b5b8947344_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2120

Network

DNS

cdd.net.ua

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

cdd.net.ua

IN A

Response

cdd.net.ua

IN A

89.184.88.6
GET

http://cdd.net.ua/apothecary/images/header_cart.gif

IEXPLORE.EXE

Remote address:

89.184.88.6:80

Request

GET /apothecary/images/header_cart.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: cdd.net.ua
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Sat, 21 Sep 2024 08:19:09 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 196
Connection: keep-alive
GET

http://cdd.net.ua/apothecary/images/infobox/corner_left.gif

IEXPLORE.EXE

Remote address:

89.184.88.6:80

Request

GET /apothecary/images/infobox/corner_left.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: cdd.net.ua
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Sat, 21 Sep 2024 08:19:10 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 196
Connection: keep-alive
GET

http://cdd.net.ua/apothecary/images/infobox/corner_right.gif

IEXPLORE.EXE

Remote address:

89.184.88.6:80

Request

GET /apothecary/images/infobox/corner_right.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: cdd.net.ua
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Sat, 21 Sep 2024 08:19:10 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 196
Connection: keep-alive
GET

http://cdd.net.ua/apothecary/images/back.gif

IEXPLORE.EXE

Remote address:

89.184.88.6:80

Request

GET /apothecary/images/back.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: cdd.net.ua
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Sat, 21 Sep 2024 08:19:09 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 196
Connection: keep-alive
GET

http://cdd.net.ua/apothecary/images/infobox/corner_right_left.gif

IEXPLORE.EXE

Remote address:

89.184.88.6:80

Request

GET /apothecary/images/infobox/corner_right_left.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: cdd.net.ua
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Sat, 21 Sep 2024 08:19:10 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 196
Connection: keep-alive
GET

http://cdd.net.ua/apothecary/includes/languages/russian/images/buttons/button_search.gif

IEXPLORE.EXE

Remote address:

89.184.88.6:80

Request

GET /apothecary/includes/languages/russian/images/buttons/button_search.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: cdd.net.ua
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Sat, 21 Sep 2024 08:19:10 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 196
Connection: keep-alive
GET

http://cdd.net.ua/apothecary/images/store_logo.png

IEXPLORE.EXE

Remote address:

89.184.88.6:80

Request

GET /apothecary/images/store_logo.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: cdd.net.ua
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Sat, 21 Sep 2024 08:19:09 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 196
Connection: keep-alive
GET

http://cdd.net.ua/apothecary/images/pixel_trans.gif

IEXPLORE.EXE

Remote address:

89.184.88.6:80

Request

GET /apothecary/images/pixel_trans.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: cdd.net.ua
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Sat, 21 Sep 2024 08:19:10 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 196
Connection: keep-alive
GET

http://cdd.net.ua/apothecary/images/table_background_browse.gif

IEXPLORE.EXE

Remote address:

89.184.88.6:80

Request

GET /apothecary/images/table_background_browse.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: cdd.net.ua
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Sat, 21 Sep 2024 08:19:10 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 196
Connection: keep-alive
GET

http://cdd.net.ua/apothecary/stylesheet.css

IEXPLORE.EXE

Remote address:

89.184.88.6:80

Request

GET /apothecary/stylesheet.css HTTP/1.1
Accept: text/css, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: cdd.net.ua
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Sat, 21 Sep 2024 08:19:09 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 196
Connection: keep-alive
GET

http://cdd.net.ua/apothecary/images/sup%202.jpg

IEXPLORE.EXE

Remote address:

89.184.88.6:80

Request

GET /apothecary/images/sup%202.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: cdd.net.ua
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Sat, 21 Sep 2024 08:19:10 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 196
Connection: keep-alive
GET

http://cdd.net.ua/apothecary/includes/languages/english/images/icon.gif

IEXPLORE.EXE

Remote address:

89.184.88.6:80

Request

GET /apothecary/includes/languages/english/images/icon.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: cdd.net.ua
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Sat, 21 Sep 2024 08:19:10 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 196
Connection: keep-alive
GET

http://cdd.net.ua/apothecary/images/header_account.gif

IEXPLORE.EXE

Remote address:

89.184.88.6:80

Request

GET /apothecary/images/header_account.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: cdd.net.ua
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Sat, 21 Sep 2024 08:19:09 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 196
Connection: keep-alive
GET

http://cdd.net.ua/apothecary/images/infobox/arrow_right.gif

IEXPLORE.EXE

Remote address:

89.184.88.6:80

Request

GET /apothecary/images/infobox/arrow_right.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: cdd.net.ua
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Sat, 21 Sep 2024 08:19:10 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 196
Connection: keep-alive
GET

http://cdd.net.ua/apothecary/includes/languages/russian/images/icon.gif

IEXPLORE.EXE

Remote address:

89.184.88.6:80

Request

GET /apothecary/includes/languages/russian/images/icon.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: cdd.net.ua
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Sat, 21 Sep 2024 08:19:10 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 196
Connection: keep-alive
GET

http://cdd.net.ua/apothecary/includes/general.js

IEXPLORE.EXE

Remote address:

89.184.88.6:80

Request

GET /apothecary/includes/general.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: cdd.net.ua
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Sat, 21 Sep 2024 08:19:09 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 196
Connection: keep-alive
GET

http://cdd.net.ua/apothecary/images/header_checkout.gif

IEXPLORE.EXE

Remote address:

89.184.88.6:80

Request

GET /apothecary/images/header_checkout.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: cdd.net.ua
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Sat, 21 Sep 2024 08:19:10 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 196
Connection: keep-alive
GET

http://cdd.net.ua/apothecary/includes/languages/russian/images/buttons/button_quick_find.gif

IEXPLORE.EXE

Remote address:

89.184.88.6:80

Request

GET /apothecary/includes/languages/russian/images/buttons/button_quick_find.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: cdd.net.ua
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Server: nginx
Date: Sat, 21 Sep 2024 08:19:10 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 196
Connection: keep-alive

89.184.88.6:80

http://cdd.net.ua/apothecary/images/infobox/corner_right.gif

http

IEXPLORE.EXE

1.2kB
1.4kB
8
7

HTTP Request

GET http://cdd.net.ua/apothecary/images/header_cart.gif

HTTP Response

404

HTTP Request

GET http://cdd.net.ua/apothecary/images/infobox/corner_left.gif

HTTP Response

404

HTTP Request

GET http://cdd.net.ua/apothecary/images/infobox/corner_right.gif

HTTP Response

404
89.184.88.6:80

http://cdd.net.ua/apothecary/includes/languages/russian/images/buttons/button_search.gif

http

IEXPLORE.EXE

1.3kB
1.8kB
9
8

HTTP Request

GET http://cdd.net.ua/apothecary/images/back.gif

HTTP Response

404

HTTP Request

GET http://cdd.net.ua/apothecary/images/infobox/corner_right_left.gif

HTTP Response

404

HTTP Request

GET http://cdd.net.ua/apothecary/includes/languages/russian/images/buttons/button_search.gif

HTTP Response

404
89.184.88.6:80

http://cdd.net.ua/apothecary/images/table_background_browse.gif

http

IEXPLORE.EXE

1.2kB
1.4kB
8
7

HTTP Request

GET http://cdd.net.ua/apothecary/images/store_logo.png

HTTP Response

404

HTTP Request

GET http://cdd.net.ua/apothecary/images/pixel_trans.gif

HTTP Response

404

HTTP Request

GET http://cdd.net.ua/apothecary/images/table_background_browse.gif

HTTP Response

404
89.184.88.6:80

http://cdd.net.ua/apothecary/includes/languages/english/images/icon.gif

http

IEXPLORE.EXE

1.3kB
1.8kB
9
8

HTTP Request

GET http://cdd.net.ua/apothecary/stylesheet.css

HTTP Response

404

HTTP Request

GET http://cdd.net.ua/apothecary/images/sup%202.jpg

HTTP Response

404

HTTP Request

GET http://cdd.net.ua/apothecary/includes/languages/english/images/icon.gif

HTTP Response

404
89.184.88.6:80

http://cdd.net.ua/apothecary/includes/languages/russian/images/icon.gif

http

IEXPLORE.EXE

1.3kB
1.8kB
9
8

HTTP Request

GET http://cdd.net.ua/apothecary/images/header_account.gif

HTTP Response

404

HTTP Request

GET http://cdd.net.ua/apothecary/images/infobox/arrow_right.gif

HTTP Response

404

HTTP Request

GET http://cdd.net.ua/apothecary/includes/languages/russian/images/icon.gif

HTTP Response

404
89.184.88.6:80

http://cdd.net.ua/apothecary/includes/languages/russian/images/buttons/button_quick_find.gif

http

IEXPLORE.EXE

1.3kB
1.4kB
8
7

HTTP Request

GET http://cdd.net.ua/apothecary/includes/general.js

HTTP Response

404

HTTP Request

GET http://cdd.net.ua/apothecary/images/header_checkout.gif

HTTP Response

404

HTTP Request

GET http://cdd.net.ua/apothecary/includes/languages/russian/images/buttons/button_quick_find.gif

HTTP Response

404
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

747 B
7.8kB
9
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

747 B
7.8kB
9
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

831 B
7.9kB
10
13

8.8.8.8:53

cdd.net.ua

dns

IEXPLORE.EXE

56 B
72 B
1
1

DNS Request

cdd.net.ua

DNS Response

89.184.88.6

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0014cba8032818a8e05945c27ecedd47

SHA1
ed267887aefdda16bbe3fdde1ef8d5c8b9a27521

SHA256
cad2a0f4927c00072bbcfd641f3e20366fdb82f1671a3fa0c92d7c93124de340

SHA512
95e79c57529817572c8b36d332bfba6969d027e1800ebbaf26d023f0f08a33df3e6cf0a63904f5f987b8bfc5cfd011f76483162ca145d3ade4f7e494e33fbeaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b35c1e4b75dff9cc625bb9e92ffa7174

SHA1
ecf33b8192759580237d2fb0883ef285fc389620

SHA256
57195334c9b5582550186bd26611963ab5f80d920894dbd0ca25e6468f0634ce

SHA512
d4bffba033f7c1da64039a272346da448212c4b20cca30f058203e51725e06163d2cddec2b16daa5498bc1ea51d9485134b66bb56228913799fb826ab1601668

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1e7faa4584cb0da0dd31a576dafd743

SHA1
ba9ece6eec6a7d8d972b42360db3751aa3221240

SHA256
988e8a649b0a495dc8c40b2a789ab41d372fe83b38ed8629bc0cc64ee5ba3246

SHA512
2ffb09b894f9621b64699189ef9139b47736724d554679c31e3f248d337cd2b3613fac22fc838114bf8886de2b393da0653a52dfbf424916f23c7c66d6984019

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b208ffaf324e085620498de9d8d5ce89

SHA1
c47d7864281ea137d5272baffeab71b8df4d3de7

SHA256
8fe365bf1b9cc69a4f7e83eb1c86ee0196ea947035b7425254558edc44baa6fc

SHA512
0ef1ddf29e9b3bebda5d228d956adb51c0af0164fab6bd3d665898927aed4290c29e37e00f8b36151263e99fb5e228cd88c96fe51ac15fbb5ec3ce10658bfc40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bca248653e11200c44d8912d5141a17

SHA1
458e2f137498aac14ef716e791bb75b4fcab388c

SHA256
15558a3acece2a6a500c9bc12e5fa7b3a3369fad522fa6b214e13c31ca9c59a9

SHA512
50e3b612f8d4c56f67a55c9d8ca826ecf49481800d32fba8ad82495a5c76226faead739e3d5bde85f7b05943353e505cc8f4a703345f41534a4c738a6a3a42d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93ade2e13db0c6024ee35cb411626a22

SHA1
b6f0178f69a75b7ca6a3cbc82b23e921aef9fd57

SHA256
1386ca6fde9ed83aac85bad03daafbbe597f38a27f2c4d530c1e4f4af6de9914

SHA512
29dfa37723fe3fabfe1be3bd971662bad3c5cc4d1b1ef190d9034bcb071ed981fd59d935a2d0276c76a256f192e0848405a120b279336e07d7d278ca8131837f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e21d511322e18a900e3e3a3e679df41a

SHA1
23d6ed4be617cd6e2e8cfa44afed5fcbd75a1ffa

SHA256
74e0a82b840cb7df80aec9de08e5090f074d863f04bc41e4d17680320f97423f

SHA512
0bd3efee3641a0cbeba88b510f8dbd6aa9bb287a6d41ff47bfdf23a556ebefc43c7385c235a05e1cb5fabdb3aa7381e570b5b3d87bfda27d97c7af48f5e5d2ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3aa6b3aec0a267894afc8c2b9f1c3f5

SHA1
9c69f2ffeaeafa63cc91dca3f392d442491b6f30

SHA256
542cce4a137f8631b7cf16e51b4338f8791e7b5567c6c62a8715c5e43c4e265a

SHA512
e81fa7643b7ecaed06c351fb1df49b823abd21f21c969732a9e83192a1ee681cddef82b1029cc664f3ca0e347cf29accc52c0579eb0b3fdc841d0286c6ff33ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9742d56ecc14270820e707aee01dc590

SHA1
27d7ca4548a382c10663060adf16016c2a70746b

SHA256
89a8fa01a3071b8333f39d3dc5b8f6659114f0b5efc4b801f301ce6be2942da4

SHA512
274402599c51a872a3dbd22bfb37af32a21bdf6d2a5bab7016fa706f8abbfcd773529c8c1462514bcace3a04442be53b5c6fa10b3b1a377bcdf2b377bc6db629

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d774cca9ae4e1d461b6b4b059a7d775

SHA1
85918c6cb01978d6da12bc6f5984c3b5b5c31337

SHA256
ef128d477e50c7626a00fe8d2592ca5ccd49181c7534ce9f6c72e53e90de46b9

SHA512
d3a23edada9d118ed0d194d5516e34ffb3ed9481ac2780c5adf5a6497c0065cfc1ad7eb0c0147d69cc289d1419aaaef48d53e10f33d13b325ea2eea831858b94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49825ce8186a9192b5d334cbb5139052

SHA1
c182a640cb95d765be8996b7ed87259369e8a49c

SHA256
db4b09d9b59c0a4f143e3e7e7c470bc9022e4f7ff28ef27a5e632f2593e9381c

SHA512
61d3f22bc85821dd179801b344987b2539e933edd5801d61876f4c54f41805f59f311fe75bf6ba85fd3f3e9c6403460df693d810e4940241a8dd0576b8a879f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c577147e1b0f0da63f452c4447fdef93

SHA1
dd00bdafe206c7a8995c856b349036e5c078bd55

SHA256
7e7a7f9908175ed98bc78519f3b341419fd038107fb16ffce71475fce01c7c66

SHA512
0383a553538de5e44ccfc3fd05a1283a19dbba1266254264598874edf66d9c45b7b2285124f706eb428843899cf0e31a6f2bec3f3bf611a87ba93828802ea3b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d42a2dddf29575778581197c98aebacd

SHA1
6f633c0a804c27a7e8dff7c0f271033bcec97be1

SHA256
c5a56301e553e2b5ede7e1f5475dba4149a9d095ff43b7c060f473be6bdf537c

SHA512
7461a79d9f92f6496f48089ab954d515a35901691dcdfdee1e45656737c17eee63c78c830df8165e02a7a19015719d0ccb82f488ae5bfa40e609d33a4e92e861

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94c5c9b5b638c528c8743c0416aae149

SHA1
71293484d31a48913278647d91bf46912eb26115

SHA256
74b0253e0cfd5375a1efe4565652ff7708af6934cd9f7f6a483a61e7e1402573

SHA512
6521de92b91888d8e19328c05d7e9a20a060ff7f2e21a4f0bba5beeb97f76111af28e645755a7e4bc8ac8f2c900d2382b5f4c746e4e13226fd8609953fe4ca6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85e6ea7cdf2023cb4a1b3b45d2307b28

SHA1
8122be78d972ce594a779507db3f074dfc68d904

SHA256
92d00a6fed31cbc8935fb9a4d94500a2fbc2be9535d45df3bacd194b59782de5

SHA512
4ec27260a06f6bd23c001297539a505c75f3c9de94306f86a153e938d50b30ac77c9943ebb637827799c21120ad060f4fe448db71bf4246e536ed43f9fef081b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afd469405ce598cafcec681891c72e24

SHA1
e948c63f96e64eb15fb3c2fdaff12016c36a09c0

SHA256
94ea739c978ac72d3933b451902a761814838b499f75327f1b1ecda992a68730

SHA512
1789b55069ed1c734f1466087e7167e4847f90722fbdcd6418b91ca6b39a679495434e1c9e8cc20be2b2031d329d356db517f5ba379e50e4f5017027c6cd2ce8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1eaa5d55da0a322ec44d1a1b87bc8c3a

SHA1
1e5bb3cc23ac41b21ed8f59f2be59a5c1387f69d

SHA256
d0cd5b9c6bc3ea56cef3ecb260b4bc482388d3744d738ed8f41703af980c0618

SHA512
3106740d759f21bb1e7a40155bc75562aef720f95fcb7431ba0cb902ede240dd2f03b1955ebf6729e0537d2aecc09bbd3c9a303527afb82e14ab543ce6a30c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51f5cc7599a857989acd17b5a3bbcf07

SHA1
b50514ac754e6eaedd5aad675ae3f8a193fe9d91

SHA256
47a590fb12b6a961634fcfe4c100dd983c7501d8b8b0c8e9613d7bfe5691511c

SHA512
6c6d026738b35d9741cc3800b46ccd7fc5679ea5fbbd7818a4cfc895ef330e07cc8997006e2d455a373bdbcbf19d059f88ead50426a46ed1b416ed410bf7652a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFAE5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFB65.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.