6713ac14b71fa36fa8c2c4b9ea81323b4c8d4626c114e4756d261a5ce37a60be

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 01:54 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d61cdf21ace8bd108876096e8c5c8d0_JaffaCakes118.html
Size

56KB
MD5

0d61cdf21ace8bd108876096e8c5c8d0
SHA1

5f3ead0572621d3365f23276cb9847ed3d02baab
SHA256

6713ac14b71fa36fa8c2c4b9ea81323b4c8d4626c114e4756d261a5ce37a60be
SHA512

a197142653a3665f0eb0b6552790447d228cc560eadf0d1b57b5a6f6adf9225634f14e67bb26a805f474972ef22cd303037a9e874de78fb9b46c583cab47af61
SSDEEP

1536:gQZBCCOdv0IxCjA8Q8U/SmG8mS18cA/+kH09sMhOhhaKFpDWsQJq0af/pGzzOdoy:gk250Ix0Q8U/SmG8mS18cA/+kH09sMhI

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000f5c238add0bcbf6d90a64e13ebe7816edc06701b029290692f1cb6d94bc4f997000000000e8000000002000020000000305dc6a9f829fd1a2ee656031c17d9ff926a7a23d8c4cd520e61034d6eb1b81720000000e97f742cf02536b378211127c608406873adc984cb768656b6171604e541059c400000003f34f546523d6133dd420729668be1b432368fc5c87035502a39bfb1c9baaa2a289c570d61b587e5aa7e29787d7cca1bcb6deaa5b5622a03cf4bf8f6eafde478	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8037e0483715db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434082343"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{70CE98E1-812A-11EF-BA5A-5EE01BAFE073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000b4f3aa5870d8ea8920f7e1200d937d84ed2904d3326c239ef2effad7707df5d0000000000e8000000002000020000000a31ab249d4acde71b8eec6c078a8acb733a89d63e43f6626d2d0afe8643366469000000053b5365b80716874f5c29388385afea0dc3cfdc1d82c444980d51a6a8b449dd26660c8dd5d61f0b8b6269e23b2c078fb594884f55c9b6b6985865223a93a197134c328ade60422caa2fe1bdb5daf3e56d6fd6b44d7f2a443fef977a193e63e20c3a6d35139b6f5bb07df0bd1a58c49830cf1582e6b39b77223fb0a9cf81db09918fdf1e4a3d3a4900668c15fea56318d400000006f0ba461afd5fc6e5e57d0f31f864a51a0ab751df3b57291c552cdee0393655cb23ed188b9d64fe901d5185c048f386cf9261892933d3a5974f2e4cea8844ba4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2844	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2844	iexplore.exe
2844	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2788	2844	iexplore.exe	28
PID 2844 wrote to memory of 2788	2844	iexplore.exe	28
PID 2844 wrote to memory of 2788	2844	iexplore.exe	28
PID 2844 wrote to memory of 2788	2844	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0d61cdf21ace8bd108876096e8c5c8d0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2788

Network

DNS

spellmanshow.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

spellmanshow.com

IN A

Response
DNS

double.boublebarelled.ws

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

double.boublebarelled.ws

IN A

Response

double.boublebarelled.ws

IN A

64.70.19.203
DNS

web.icq.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

web.icq.com

IN A

Response

web.icq.com

IN CNAME

www.icq.com

www.icq.com

IN CNAME

www.ovip.icq.com

www.ovip.icq.com

IN A

5.61.236.229
DNS

spellmanshow.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

spellmanshow.com

IN A

Response
GET

http://double.boublebarelled.ws/FrMal

IEXPLORE.EXE

Remote address:

64.70.19.203:80

Request

GET /FrMal HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: double.boublebarelled.ws
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: openresty
Date: Thu, 03 Oct 2024 01:54:40 GMT
Content-Type: text/html; charset=ISO-8859-1
Content-Length: 577
Connection: keep-alive
Access-Control-Allow-Origin: *
GET

http://web.icq.com/whitepages/online?icq=8765463453&img=5

IEXPLORE.EXE

Remote address:

5.61.236.229:80

Request

GET /whitepages/online?icq=8765463453&img=5 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: web.icq.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Server: kittenx
Date: Thu, 03 Oct 2024 01:54:40 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://web.icq.com/whitepages/online?icq=8765463453&img=5
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
GET

https://web.icq.com/whitepages/online?icq=8765463453&img=5

IEXPLORE.EXE

Remote address:

5.61.236.229:443

Request

GET /whitepages/online?icq=8765463453&img=5 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: web.icq.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Server: kittenx
Date: Thu, 03 Oct 2024 01:54:41 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://icq.com/
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
DNS

www.website.ws

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.website.ws

IN A

Response

www.website.ws

IN CNAME

website.ws

website.ws

IN A

64.70.19.170
DNS

icq.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

icq.com

IN A

Response

icq.com

IN A

5.61.236.229
GET

https://icq.com/

IEXPLORE.EXE

Remote address:

5.61.236.229:443

Request

GET / HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: icq.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Moved Temporarily

Server: kittenx
Date: Thu, 03 Oct 2024 01:54:41 GMT
Content-Type: text/html
Content-Length: 154
Connection: keep-alive
Location: https://icq.com/en
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
GET

https://icq.com/en

IEXPLORE.EXE

Remote address:

5.61.236.229:443

Request

GET /en HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: icq.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Moved Temporarily

Server: kittenx
Date: Thu, 03 Oct 2024 01:54:41 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://icq.com/desktop/en#windows
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy-Report-Only: default-src 'none'; script-src icq.com c.icq.com cicq.org 1l-hit.mail.ru www.google-analytics.com buddyicon.foto.mail.ru www.googletagmanager.com top-fwz1.mail.ru 'sha256-DKOsdd00IXAHc7qK64HiC18YrB2K4SfiH8Sl6A9aFyg=' 'sha256-u4WiMVZhYDdCrFwB8Zn3gLba1EI3pqIlFYWFZfXJl2I=' 'sha256-ynzJCJTMBeZF6kbmzoI2rC+vDRozRAHxsPfAruxve88=' 'sha256-j51JRkq0bwz97Hd/1wJQsIy6/aX9cz16Xyp+M8FshTA=' 'self'; style-src c.icq.com icq.com cicq.org 'self' 'unsafe-inline'; img-src data: icq.com c.icq.com cicq.org api.icq.net www.google-analytics.com buddyicon.foto.mail.ru files.icq.com files.imgsmail.ru u.icq.net u.myteam.vmailru.net ub.icq.net ub.myteam.vmailru.net swa.icq.com stats.g.doubleclick.net 'self'; media-src data: icq.com c.icq.com cicq.org api.icq.net www.google-analytics.com files.icq.com api.icq.net files.imgsmail.ru u.icq.net u.myteam.vmailru.net ub.icq.net ub.myteam.vmailru.net 'self'; font-src icq.com c.icq.com cicq.org 'self'; connect-src privacy.icq.com icq.com top-fwz1.mail.ru 'self'; report-uri /system/error
Content-Security-Policy: upgrade-insecure-requests
X-XSS-Protection: 1; mode=block; report=https://cspreport.mail.ru/xxssprotection
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
GET

https://icq.com/desktop/en

IEXPLORE.EXE

Remote address:

5.61.236.229:443

Request

GET /desktop/en HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: icq.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: kittenx
Date: Thu, 03 Oct 2024 01:54:42 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy-Report-Only: default-src 'none'; script-src icq.com c.icq.com cicq.org 1l-hit.mail.ru www.google-analytics.com buddyicon.foto.mail.ru www.googletagmanager.com top-fwz1.mail.ru 'sha256-DKOsdd00IXAHc7qK64HiC18YrB2K4SfiH8Sl6A9aFyg=' 'sha256-u4WiMVZhYDdCrFwB8Zn3gLba1EI3pqIlFYWFZfXJl2I=' 'sha256-ynzJCJTMBeZF6kbmzoI2rC+vDRozRAHxsPfAruxve88=' 'sha256-j51JRkq0bwz97Hd/1wJQsIy6/aX9cz16Xyp+M8FshTA=' 'self'; style-src c.icq.com icq.com cicq.org 'self' 'unsafe-inline'; img-src data: icq.com c.icq.com cicq.org api.icq.net www.google-analytics.com buddyicon.foto.mail.ru files.icq.com files.imgsmail.ru u.icq.net u.myteam.vmailru.net ub.icq.net ub.myteam.vmailru.net swa.icq.com stats.g.doubleclick.net 'self'; media-src data: icq.com c.icq.com cicq.org api.icq.net www.google-analytics.com files.icq.com api.icq.net files.imgsmail.ru u.icq.net u.myteam.vmailru.net ub.icq.net ub.myteam.vmailru.net 'self'; font-src icq.com c.icq.com cicq.org 'self'; connect-src privacy.icq.com icq.com top-fwz1.mail.ru 'self'; report-uri /system/error
Content-Security-Policy: upgrade-insecure-requests
X-XSS-Protection: 1; mode=block; report=https://cspreport.mail.ru/xxssprotection
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
DNS

www.microsoft.com

iexplore.exe

Remote address:

8.8.8.8:53

Request

www.microsoft.com

IN A

Response

www.microsoft.com

IN CNAME

www.microsoft.com-c-3.edgekey.net

www.microsoft.com-c-3.edgekey.net

IN CNAME

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

IN CNAME

e13678.dscb.akamaiedge.net

e13678.dscb.akamaiedge.net

IN A

92.123.241.137
DNS

www.microsoft.com

iexplore.exe

Remote address:

8.8.8.8:53

Request

www.microsoft.com

IN A

Response

www.microsoft.com

IN CNAME

www.microsoft.com-c-3.edgekey.net

www.microsoft.com-c-3.edgekey.net

IN CNAME

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

IN CNAME

e13678.dscb.akamaiedge.net

e13678.dscb.akamaiedge.net

IN A

92.123.241.137

64.70.19.203:80

http://double.boublebarelled.ws/FrMal

http

IEXPLORE.EXE

724 B
942 B
10
4

HTTP Request

GET http://double.boublebarelled.ws/FrMal

HTTP Response

200
64.70.19.203:80

double.boublebarelled.ws

IEXPLORE.EXE

328 B
48 B
7
1
5.61.236.229:80

http://web.icq.com/whitepages/online?icq=8765463453&img=5

http

IEXPLORE.EXE

573 B
683 B
6
5

HTTP Request

GET http://web.icq.com/whitepages/online?icq=8765463453&img=5

HTTP Response

301
5.61.236.229:80

web.icq.com

IEXPLORE.EXE

190 B
124 B
4
3
5.61.236.229:443

https://web.icq.com/whitepages/online?icq=8765463453&img=5

tls, http

IEXPLORE.EXE

1.3kB
5.5kB
13
13

HTTP Request

GET https://web.icq.com/whitepages/online?icq=8765463453&img=5

HTTP Response

301
64.70.19.170:443

www.website.ws

tls

IEXPLORE.EXE

395 B
215 B
5
5
64.70.19.170:443

www.website.ws

tls

IEXPLORE.EXE

395 B
215 B
5
5
5.61.236.229:443

icq.com

tls

IEXPLORE.EXE

984 B
4.9kB
11
12
5.61.236.229:443

https://icq.com/desktop/en

tls, http

IEXPLORE.EXE

2.1kB
20.1kB
18
24

HTTP Request

GET https://icq.com/

HTTP Response

302

HTTP Request

GET https://icq.com/en

HTTP Response

302

HTTP Request

GET https://icq.com/desktop/en

HTTP Response

200
64.70.19.170:443

www.website.ws

tls

IEXPLORE.EXE

524 B
215 B
6
5
64.70.19.170:443

www.website.ws

tls

IEXPLORE.EXE

357 B
215 B
5
5
64.70.19.170:443

www.website.ws

tls

IEXPLORE.EXE

288 B
215 B
5
5
64.70.19.170:443

www.website.ws

tls

IEXPLORE.EXE

288 B
215 B
5
5
64.70.19.170:443

www.website.ws

IEXPLORE.EXE

190 B
88 B
4
2
64.70.19.170:443

www.website.ws

IEXPLORE.EXE

190 B
88 B
4
2
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

747 B
7.8kB
9
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

747 B
7.8kB
9
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

779 B
7.8kB
9
12

8.8.8.8:53

spellmanshow.com

dns

IEXPLORE.EXE

62 B
62 B
1
1

DNS Request

spellmanshow.com
8.8.8.8:53

double.boublebarelled.ws

dns

IEXPLORE.EXE

70 B
86 B
1
1

DNS Request

double.boublebarelled.ws

DNS Response

64.70.19.203
8.8.8.8:53

web.icq.com

dns

IEXPLORE.EXE

57 B
114 B
1
1

DNS Request

web.icq.com

DNS Response

5.61.236.229
8.8.8.8:53

spellmanshow.com

dns

IEXPLORE.EXE

62 B
62 B
1
1

DNS Request

spellmanshow.com
8.8.8.8:53

www.website.ws

dns

IEXPLORE.EXE

60 B
90 B
1
1

DNS Request

www.website.ws

DNS Response

64.70.19.170
8.8.8.8:53

icq.com

dns

IEXPLORE.EXE

53 B
69 B
1
1

DNS Request

icq.com

DNS Response

5.61.236.229
8.8.8.8:53

www.microsoft.com

dns

iexplore.exe

63 B
230 B
1
1

DNS Request

www.microsoft.com

DNS Response

92.123.241.137
8.8.8.8:53

www.microsoft.com

dns

iexplore.exe

63 B
230 B
1
1

DNS Request

www.microsoft.com

DNS Response

92.123.241.137

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
2669252f3038b7a4642a31c49b6c9cbe

SHA1
4cc6394f4e8c22ed31eb5adda7a39736f38ebb2c

SHA256
75640f6b1554bb126492c5d6f039db38de7b79f7ae30cf826f2fa2e195f0e1ca

SHA512
8b76a3a3386888ea5b99d111e066248de4d00e2aaace2754a12d354624c2e2d9d2816b144804da834ed014fa847c2e701caf83e2de8808e5895ded5cc9aaf0ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
823f57dea17575e4a3ba834e0dfeab15

SHA1
07ec7b13512d9fcd4848f487c48a855bb4a2355c

SHA256
201883e96b1fc1c8060912e2680712fbbaecfcce02dfc270b5be0c19c9a3b019

SHA512
ac7711d9195c9f99205e960435ed6c253dfdd97e9494443688ba02c3dca7762d5145c1af17b13d4a346ea8c641c908f9532b52e8214fd55f6301e9bb1d23be97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1289e9976e39d3ccd941c10f31ee22c

SHA1
c82cd9bea4043c14a733fe4d9aac5fe2e0e7e717

SHA256
2332a7e76b62b41a363712691c4db1bf40a53297ac98524458bc7d30b1466c89

SHA512
aceab6dce6dbc85cef3d2e9475d5fec17f756d1476b328a72c9d2f2f4926acde184cf8a65c14d280a9bef46783440c88ff18cf987548e55ff10d98a9d0d55cbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bf72d84dc8f0011991b973686797f7b

SHA1
fb1063713b8e3b84569af4c73582a2a7a68df2b0

SHA256
a74d71ffa40d7e7eb68b68879e2b4eec03ee1b19f01dbdfbeb1fba60ead348cc

SHA512
df24b7f5845ba17c9f99451b296730e451088d8b947c6f1850c92f36e519656c71e64e8afafc5d94f2246c9303729842df3a5d61ccec993ca9b32e277a36b1e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18a355045577c96e76a20a6bd527ef28

SHA1
885150a38a8d7bda121c3906dc974777e39cea40

SHA256
20111a7a93e9f64fb56856669080cc41bdedd9e3fc0798caaf2df0d38d4b383f

SHA512
30e66825a12400fe4ca34d5e6b0ab1bcb9fafc0f0198733312220fdad5abdb1173405c612542c05746a29f48c1f04f318543579218231a8898efeaeb62c0858c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
831eb55f4b60a52750717505cf5c278d

SHA1
997e0eeb383ba06b7e94109da230223d2cf0a66f

SHA256
1ca493f461f97a271973fb41ba0265a010b244617cceb49a13a5b133aafb5346

SHA512
2fb7a2bd2954ce097edd01c5c60a5c4a3c2116158e2aa0d4a3ef12fbb9a5e72629305d6ef9c675e833d1a41379b00e99fd13bc2d46b27187dcc1c5ce4de17048

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c18755fadad4053f800ce153564bf313

SHA1
c532180c5ef6587ff0f0177d713eaa032e2a33c4

SHA256
fb3817d99e4e684aef688beeebf3d90d78db750359cc32b9ff87b1b79ded72fd

SHA512
47bfe9ea30c58009165468d5b2601dff958f30862218f664fd31d28780b1eeeda11e6bc2f6360226255e47969602367c4b3e4d8f4dc5f0a30a68745511cc27a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4857cc0ae55740ee46bfa355c159c892

SHA1
62e17d9096aa5fb439cc602c7cd4cd0b0e18aeb8

SHA256
b28519b5ba4d730882825eabd2a6a8270598565e8f1e8000a6b10cda24d14efd

SHA512
853aa9dbef41155ee5d7c48783a3f02c6c96c641f30c65a5e31958b11d20f708585e5eef5f97352634f93d1917a0b85dfbc2974554776825e95ae68e4a8bdc4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
152bb70e4f2e08a9b5c84d10c5ae7698

SHA1
6db8a513ffd36413e68aba48e64ffe5c58eaa496

SHA256
0df1aed8979ba3b6f4662e5d3af36dcb2414ad1cc703ba18f04f057aa22b308b

SHA512
4317f72b59768fb98720034af751a7677bf354a408e3511a21819b6ce7eacedabc48e2bd0e9bad297dc3f0eb13f5ef6d0cc7ed8e5b18b058cbc87b93683db0aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a588b9f61bdc2c723212c1a8512736f6

SHA1
ef74c1d5a4735f14f0aab138c86e11767772e411

SHA256
f17cf598d3e08e06b7b615f06c5e34d73e7d301dfa9477527d6c2221a82f3164

SHA512
e670b93e07c725a7ba665c91bbee1b0f791e40832c3aa42ba6e6ddcd74c196b2f92fa56b6487498d02a85d8a17334e75fa82b919beabb6e0d6bbeb4297f453be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e34bbef145e00f4ada458aea42d48794

SHA1
b5355b2337e924833b17cb2af303e7a37dab515e

SHA256
c989f0a7f30ac8b828692961852cc406226d35cf73c4cfc3f46bdce678b37c50

SHA512
7a00c70ca2cb36c1341bff254bc83b4ea29f56c70299490217dcb28fe3ec14f49612bc5e164c5ee9410f1ce9dfd0991cedf80da5f9c7cf74e81fc3b200be97ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b61e2a58c79b70a06d96bf3c88234b85

SHA1
f7fd45aaffaa9e8def1b0248b5b6fea3574158da

SHA256
849137f8bf586688626d1927d287af0eb0fb710fec2d1c11b07e4e21e53ed0f3

SHA512
bb14f36c5cf5beb36092b297f33714fed9516c1b29af935f7d019e4edf10511718ad32f606e6bfb43a9035b479e60db96675a17936dd5c343b18029f5d03369b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
468ee59ecbad86ef413044988c9c2cfe

SHA1
ca4b7a3d433d87166f189bd0a039ed0ce1f98bd7

SHA256
34b4192fbd09e7cf98328ac2a7defd17534a86dc330f5f8940d845d461a60f78

SHA512
fbc79cef13f93714cf3076f091a2595a47e58c1101da2a0de44b9cb3427157b3983194be58cd23a96359222cfa02ed9580927db83e51d7950ea617dade6d6ee9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd1c9a16435302c075b1d98bdea50927

SHA1
8968ca4026f4f3ff714ed152bdf76a1d5275fc9f

SHA256
a72a13c3b5cc34d68a373853836d2544f249d6363896190c88fe0c2c29b33b13

SHA512
c9710807d429f770b471c55d8e5d8bbca0c4e39703571f95f32f4dba1b28ae0e00bd705e4fff7e4fcde16750205b95894f409af52987c99b44fd35071f02b60f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5baf79bfed620db516abcfb49df18a0b

SHA1
e5620379bf4308d9948c678096e3c94073c02b1f

SHA256
2a9d0b3407da18b9b6d6580d5117169ed0abdf289d1c719c8a3459ca8836abc3

SHA512
2b6e01ac9ae5640a6cb76adea7d04e64c23997f0745b30d833caf3baa997d7431e64359257cca3651a93d6adc59be3295b4f82e0951bba4ace22d79dcfdab2a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18ed760160c7f68ec424409df023bca0

SHA1
4b37fb89c6c896767bfa48f527bb5daf1c0c6fc4

SHA256
602341a1878b72748db8bfc9ca1b81c2cad14556974e96d003b8912006b0208d

SHA512
b36344807cc6a418a709081fe713208dced062265d8cc2b96ed560b596e40778fe0d48d5dafcbf25c98f10efccc1289c5c519ef6a6bc0e850094ff78d879cd22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83f66c443ffac753c48c8ad2249b600d

SHA1
4146c29c2f4a0fd584476a9ce56f2fb8830b3769

SHA256
50a2efd062500cdae77165ce8e7af6d6c7b1a031daa7c917e89146987209ffb8

SHA512
8f6231a0c49fbe25e48e4d3a0da1fb2e6378e40bf11b2eedc97e58dc98500995c46f91e7afdc70dcb5fbc040885bf482a467110bf977be6d9ac3810ca1ba0ff1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24d60f6eb9c167127519d16c2baeb0c7

SHA1
dbc93f166f14deab957b2f74cd242b9c82a82bcb

SHA256
1eb0ff1fc1635782299997d5cd9eef0dafbd0778a8f4bb4bb4ec5db136c5f920

SHA512
98f2ea2e0ae905c1bca4a5c3cc88356a4965b444e69b944b308cac841bee643d4f8a2df8fcf4a7afbf36c8bf97e84c289359b5f10de870c0a1ab047e9028def5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
98d7b91cd2e82c2db92766dccc05c6e7

SHA1
26604812fae69af00c25489a3175e0c15c69515f

SHA256
2497b0f9c4af4b0ad3a670df5aa8744f64c3ecb6255046d3f788b25d4919c1ce

SHA512
d5bca9453a107c0804cec472866892db05278038c969eca1227ed0f5ad5125ddaa13e0ba05d209a2a590d9b94a50316691d8520dbfc3da88b152aa7a3ad5ab48

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB7CC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB7CF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.