dbaaae193b441a82525658f263529b28bcd851b2f5ef4ffa7655b3ace443946c

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 02:35 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

380b5c79282d2ecf6c46e1b3f804f0d1_JaffaCakes118.html
Size

26KB
MD5

380b5c79282d2ecf6c46e1b3f804f0d1
SHA1

e3c18ba677aeaaae10be1401be6c873e240c10d1
SHA256

dbaaae193b441a82525658f263529b28bcd851b2f5ef4ffa7655b3ace443946c
SHA512

d8534abc44b323f18dfae6d91b04d9016e24d2fb1c641e5277945abd84a45288179381b877af2c2775fe35a6d5dae0fa821e186d365d804230741495c3f80b02
SSDEEP

768:SSftdhtkV3kK4jozPw8lpD2K5+lFFSkBgFcnclFL:SSftdhtktXgozPw8lpD2K5+lFFSkBgFN

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea220000000002000000000010660000000100002000000082ce60c93aa62122651542bb0a62ff1857e9be85f393f303c93fb627b92974a6000000000e80000000020000200000003c1f851084597723203e0e2b7183a999774d3b83e382eae8f93400b083e71f19900000008d9da12e1cf504f34cce59a5be725462d6d263a9523b99d0bc55814f08ad3a398bd6c779cf5392637505c61919d94ce0e63833a18877667462774d8085f46ac3c99595033efdad656a59771c8632c17284c1b9a9c9e4df5cbb222ad4cf6ec35959919a486eb6fe98be33a7b57ccf9dff6ba953b53341c9b3b54b9e12c3ae968d1b0fc94a1beefe435a8bb09de05263fd400000005d0d96fa34feac5a0b03a9c0203b10f35fa7a3d7dc7b033279c01362fd0fccbbaf953b81534a553619ce47a44b59ecbe466e1f3bb3fd6910e64f29cdd00ffc71	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E121151-8842-11EF-AC30-EA7747D117E6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000016382887a27d5e4cb599491a3cbbfe3b62b6bc1e1acb27a6c606fc97d82018a000000000e8000000002000020000000dfe890bf9f1a6ee9623bd41b413a9f23d7e40220b720d4bb33161b404e40416d20000000884b3fc072ee8ccea0edd5936c064e9a43ac9d8463cf6d6e6dc6e70ee34cfeb74000000056e42e6773b4f6f328cc24c448ce1c556a74b3ebafa4df581e6de36841f04aeb0d37a210a0569215fd4b3f304a401c696f70b0d5f24e05388ce0e7758fa43101	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a09d9d7c4f1cdb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434862385"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2800	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2800	iexplore.exe
2800	iexplore.exe
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2872	2800	iexplore.exe	30
PID 2800 wrote to memory of 2872	2800	iexplore.exe	30
PID 2800 wrote to memory of 2872	2800	iexplore.exe	30
PID 2800 wrote to memory of 2872	2800	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\380b5c79282d2ecf6c46e1b3f804f0d1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2800 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2872

Network

DNS

www.188126.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.188126.com

IN A

Response

www.188126.com

IN A

119.42.144.42

www.188126.com

IN A

103.194.186.235

www.188126.com

IN A

38.47.240.77
DNS

IEXPLORE.EXE

Remote address:

119.42.144.42:80

Response

HTTP/1.1 301

Content-Type: text/html
Cache-Control: max-age=86400
Content-Length: 0
Connection: close
Location: https://saocdn.net:9527/138/ip.php
DNS

IEXPLORE.EXE

Remote address:

119.42.144.42:80

Response

HTTP/1.1 301

Content-Type: text/html
Cache-Control: max-age=86400
Content-Length: 0
Connection: close
Location: https://saocdn.net:9527/138/ip.php
DNS

IEXPLORE.EXE

Remote address:

119.42.144.42:80

Response

HTTP/1.1 301

Content-Type: text/html
Cache-Control: max-age=86400
Content-Length: 0
Connection: close
Location: https://saocdn.net:9527/138/ip-1.js
DNS

IEXPLORE.EXE

Remote address:

119.42.144.42:80

Response

HTTP/1.1 301

Content-Type: text/html
Cache-Control: max-age=86400
Content-Length: 0
Connection: close
Location: https://saocdn.net:9527/138/ip-1.js
DNS

saocdn.net

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

saocdn.net

IN A

Response

saocdn.net

IN A

38.181.22.91

saocdn.net

IN A

104.143.33.25
GET

https://saocdn.net:9527/138/ip.php

IEXPLORE.EXE

Remote address:

38.181.22.91:9527

Request

GET /138/ip.php HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: saocdn.net:9527
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Server: openresty
Date: Sat, 12 Oct 2024 02:35:28 GMT
Content-Type: text/html
Content-Length: 99
Connection: keep-alive
ETag: "66292215-63"
X-Cache: MISS
GET

https://saocdn.net:9527/138/ip-1.js

IEXPLORE.EXE

Remote address:

38.181.22.91:9527

Request

GET /138/ip-1.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: saocdn.net:9527
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Server: openresty
Date: Sat, 12 Oct 2024 02:35:36 GMT
Content-Type: text/html
Content-Length: 99
Connection: keep-alive
ETag: "66292215-63"
X-Cache: MISS
DNS

r10.o.lencr.org

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

r10.o.lencr.org

IN A

Response

r10.o.lencr.org

IN CNAME

o.lencr.edgesuite.net

o.lencr.edgesuite.net

IN CNAME

a1887.dscq.akamai.net

a1887.dscq.akamai.net

IN A

2.23.210.82

a1887.dscq.akamai.net

IN A

2.23.210.75
GET

http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgQr1XYZ0%2BIr8ad7fu%2B3L%2F9Y6A%3D%3D

IEXPLORE.EXE

Remote address:

2.23.210.82:80

Request

GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgQr1XYZ0%2BIr8ad7fu%2B3L%2F9Y6A%3D%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: r10.o.lencr.org

Response

HTTP/1.1 200 OK

Server: nginx
Content-Type: application/ocsp-response
Content-Length: 504
ETag: "FB251A8A86D280A653804D2FEFD4454B9C5D85482CFA16897880B059689EA9BD"
Last-Modified: Wed, 09 Oct 2024 12:58:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4538
Expires: Sat, 12 Oct 2024 03:51:05 GMT
Date: Sat, 12 Oct 2024 02:35:27 GMT
Connection: keep-alive
DNS

crl.microsoft.com

Remote address:

8.8.8.8:53

Request

crl.microsoft.com

IN A

Response

crl.microsoft.com

IN CNAME

crl.www.ms.akadns.net

crl.www.ms.akadns.net

IN CNAME

a1363.dscg.akamai.net

a1363.dscg.akamai.net

IN A

2.19.117.22

a1363.dscg.akamai.net

IN A

2.19.117.18
GET

http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

Remote address:

2.19.117.22:80

Request

GET /pki/crl/products/MicRooCerAut2011_2011_03_22.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 11 Jul 2024 01:45:51 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com

Response

HTTP/1.1 200 OK

Content-Length: 1036
Content-Type: application/octet-stream
Content-MD5: 8M9bF5Tsp81z+cAg2quO8g==
Last-Modified: Thu, 26 Sep 2024 02:21:11 GMT
ETag: 0x8DCDDD1E3AF2C76
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 0d86e878-601e-0013-6cbc-0f73e6000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Sat, 12 Oct 2024 02:36:00 GMT
Connection: keep-alive
DNS

www.microsoft.com

iexplore.exe

Remote address:

8.8.8.8:53

Request

www.microsoft.com

IN A

Response

www.microsoft.com

IN CNAME

www.microsoft.com-c-3.edgekey.net

www.microsoft.com-c-3.edgekey.net

IN CNAME

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

IN CNAME

e13678.dscb.akamaiedge.net

e13678.dscb.akamaiedge.net

IN A

92.123.241.137
DNS

www.microsoft.com

iexplore.exe

Remote address:

8.8.8.8:53

Request

www.microsoft.com

IN A

Response

www.microsoft.com

IN CNAME

www.microsoft.com-c-3.edgekey.net

www.microsoft.com-c-3.edgekey.net

IN CNAME

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

IN CNAME

e13678.dscb.akamaiedge.net

e13678.dscb.akamaiedge.net

IN A

92.123.241.137

119.42.144.42:80

www.188126.com

http

IEXPLORE.EXE

512 B
797 B
11
8

HTTP Response

301

HTTP Response

301
119.42.144.42:80

www.188126.com

http

IEXPLORE.EXE

604 B
644 B
13
8

HTTP Response

301

HTTP Response

301
38.181.22.91:9527

https://saocdn.net:9527/138/ip.php

tls, http

IEXPLORE.EXE

1.2kB
3.8kB
11
8

HTTP Request

GET https://saocdn.net:9527/138/ip.php

HTTP Response

404
38.181.22.91:9527

https://saocdn.net:9527/138/ip-1.js

tls, http

IEXPLORE.EXE

1.4kB
3.9kB
13
9

HTTP Request

GET https://saocdn.net:9527/138/ip-1.js

HTTP Response

404
2.23.210.82:80

http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgQr1XYZ0%2BIr8ad7fu%2B3L%2F9Y6A%3D%3D

http

IEXPLORE.EXE

527 B
1.9kB
6
4

HTTP Request

GET http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgQr1XYZ0%2BIr8ad7fu%2B3L%2F9Y6A%3D%3D

HTTP Response

200
2.19.117.22:80

http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

http

706 B
1.7kB
6
5

HTTP Request

GET http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

HTTP Response

200
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

747 B
7.8kB
9
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

747 B
7.8kB
9
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

779 B
7.8kB
9
12

8.8.8.8:53

www.188126.com

dns

IEXPLORE.EXE

60 B
108 B
1
1

DNS Request

www.188126.com

DNS Response

119.42.144.42

103.194.186.235

38.47.240.77
8.8.8.8:53

saocdn.net

dns

IEXPLORE.EXE

56 B
88 B
1
1

DNS Request

saocdn.net

DNS Response

38.181.22.91

104.143.33.25
8.8.8.8:53

r10.o.lencr.org

dns

IEXPLORE.EXE

61 B
160 B
1
1

DNS Request

r10.o.lencr.org

DNS Response

2.23.210.82

2.23.210.75
8.8.8.8:53

crl.microsoft.com

dns

63 B
162 B
1
1

DNS Request

crl.microsoft.com

DNS Response

2.19.117.22

2.19.117.18
8.8.8.8:53

www.microsoft.com

dns

iexplore.exe

63 B
230 B
1
1

DNS Request

www.microsoft.com

DNS Response

92.123.241.137
8.8.8.8:53

www.microsoft.com

dns

iexplore.exe

63 B
230 B
1
1

DNS Request

www.microsoft.com

DNS Response

92.123.241.137

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
f4ae706938296d7d618e63c5a45d0dab

SHA1
fbe931635a861ea13e6f2bbbe0a56cf6ea756ea5

SHA256
492cab41068a59755327f4c8304032d0b1b4efc85cf2e6f797c7dda8701045ee

SHA512
5faeba4900980da8b788b89b436ca5112fa7e102923e39e7b215fc00daac9ab6b54fdce7817a10faceb37aaeb03ce18b66c2515dc17bed76bc4c73b842a58535

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2acd1a2362c37425e32763dca9f7900

SHA1
56d7fae3b022b0d37df62339c0298d34b94d5338

SHA256
6cbe78365be6fcff877e9d91c6383ba29af9aec8ca8be072891aebe1f695c666

SHA512
459d0337b1c87896feb582cee770d7f27935b6c2929ef0f370e2b68eedf85eba35bcf7243d5dc145c124f3f680a5b4e0cbf269b1c6eab3ff1ad788b5ba09a8dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
949f59c6a1aed97bca82604d66147423

SHA1
e1bc18d69c0a0c0ec44954a43d6cf4ddf44cf734

SHA256
9b8e053047ca9299f871e775b0f148caca3712d1586604d27ec6e671a582bff2

SHA512
2701a53898a6f64aa9f99ddcad3d9a6eff5d52919a4769ccd1e4c369a611d3c1708c4e82e65cca19f2e322c7ca1e805bdc710fb76edabc6ba5d3cad1949de937

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1012d3392a35ea2d1df25d15d0cf4173

SHA1
e98ca9259f76a850b4b09dc2db0c1bcdcc992f04

SHA256
af85d5a3eaea1a76e7852e3e1a413a11b1017d27165192e9034b68005d40e9e2

SHA512
e81e95bd53c713dabc2d1b0d508029646dcac1aaa5cf981e53ec4ff911dddf585d4947b27752b139e536c09d2303128f9dd42d0ec2ac93eb3cec559a4e1a9255

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9dea07cf3b9efac5256a46eed46ae76

SHA1
f54ab309be6388f2c94b27d3b3f89ba611f89c6b

SHA256
b01a3b0726265e439408498f9f21c778c2908b102ad03b9420bcb42aa6bfae46

SHA512
3e097a45b3503a3d3b65ebcdab61ad9c76a9baf3a92a88bcbce23c83436c6c1b9c24acdb0422121752a5842a43ba7046a72ed4864da2349d0781e5bc030b9ac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a847bdc6f10bb8d793c10e35daa8de52

SHA1
946b1096759964a067a2b5602c8167c7eab8b280

SHA256
e14f5d2fe79d3487b0d763435d75ed8a7e6b127629bd8403d02a750f7e7c6dd7

SHA512
88e6c744d1c9990ccfd5d33631bb80b72ae8d1bc54ef0832d5f6e73859c1e02e0d11bda9c4a11181df4acf0f573f82857b9bc2ee5db7cde8c26dd714e33d25ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f9b49b21f6035c914f1e7af4576cf98

SHA1
b002a8b270558edcd022214a86b37cb720d9a98b

SHA256
30e76ed6e1cc737d124d9607d9b82852afc21314869e4b7c35b2693c260758ad

SHA512
c386c7645ec46667f4ae24507a265a17a4509b5b0460a70aeaf178b98038cf4ff3e523ba00e8b7a49abfed951f7598d0d0b4e15d8e71a45b1bec299b838ad9da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a398caae5adc0c25f350e1edb084547

SHA1
c22a39375d6b3023423b0a380f9a5aaa9ab0098f

SHA256
622f92b56fabc3d434f0a372ee8c69d65c0e13e3a29698c8e1ad1fa6da36343a

SHA512
d468d74194f134becf014fcd499f1de3ddecb8f716872d7ceb601b1652fc9b04994b52385e5cc35a47c4d4b4fa66c70d174203fee903f932257f442436b50359

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3902160aaf0fdd20f8c1fd0df51a367d

SHA1
78b9f17a215e8a838e500ef8ccc92165a60d44ab

SHA256
e4616109af02cc56167c93c619cd34b97495b1ec3450c10dd3f32183563d16a2

SHA512
c6096d862884d2873254eed552d2669dd809373417a033b56867de4688109974f099a98e507ff961ddeed7ce851d9729d4da3b68b19e39843568a09aa55a89fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af5321294de4efa8917fa11de75e58bf

SHA1
15ab89dd41e91687a1cc627d687ae16ad7b03586

SHA256
ea1e3c6c436d445853f0c74aa65d428a9b34c2089f4b5cfd9eb90e9cc1ed9548

SHA512
d21abe036c99117cfbb2b0d6dd735427f36569ab5445cde45d9a3cfd0dcb685b44c66ed8fd29300d54446d9f6969f754a81ba7d28fb03c05a16223075286ff92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab4b70365c2d60eb735359801e4ff2b4

SHA1
66e752d7e380881b2e91c68de8698be6fb38850e

SHA256
13204824a53e9f052fa38ecaaa54a6a71dfa6727c672b3f6653a18f2f4c18bc8

SHA512
f7023bf415c5bcd33849f7ec47673f3dc269e1f8046bb625e6c72e116389a5a4b3e30dbd0cb06755eb3b473f2b3cec1fda984beea2be97c06f811b63fe07d19a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc87d87613128bf87610f9474ce564a0

SHA1
dbd442e70549619604697d12f85c50c0765b326e

SHA256
31ed90ddcb3975ea463c691a2396527962eae16ea97242c946844de952b60b05

SHA512
ff860c431445d5f8c2dbea5ef077c5d69fcadbec396d1e059cce943bda989bb982bb2de1f7f89d1dd78d92ae7cdc39fbd60fba5874436472727e51fc9be9dc04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97a05d63e8881622b8dc739fcfced796

SHA1
b5ca00c182000e9a5858b3eed74d3936b047c5c8

SHA256
1752aba28d2bee5847071a278b1a2bb7c080c4e06bbdf6a38c12206b70a8582c

SHA512
3a246d2a38d9550399e19739445e37e59d9a845a2996f557bafa940cbe3f2e35ced382ef8eb27747064974a775d0560b36f219c9bb2148edf2215d55f794e7d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
326189e877e0888811eb3ce7ed64d150

SHA1
fc6aae39d302159f6b50663b72f417b93b0d3b9f

SHA256
83a4050121f6372143de0f49ef7816042bce6675f9c3ea7317ed1c21160566fa

SHA512
1f1fbf38253cce82699204dc85e378ad31e917346b3f2ed1b8a2045e73fe9682c7d0a045f28b63d4a992298030eced35007b365ff2debade4eb0157cfac8ce56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a0f154c96a8bc1a3bfcf539bf50d176

SHA1
d7aafb2528d6cd29cc561b1a56ed43a6829e3b39

SHA256
c5f5971356938596c2974a2993934e806e05fe2daf0555abf4edb6df730f2320

SHA512
477c5b7bab1cdc82d25c544ebedc771c503551f17b850e836a11c393701d674b1f590662633c1b1840f45c0874c30f6ada66e009a1f4a332f45a2a261b3f4a57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d3b0aa62724b1329e3d7c5319efbb27

SHA1
acef53922a3b59f4b195e2e97c20e8dfcb2abc23

SHA256
8d7beb9490509c73d0ba1deeaeb621a3cc8651f1618fec7a01ce22165cc14b0c

SHA512
9c1e7494f7f7ebaf599078d4449719d2b137e00f96dcb2b6f96d71ab17358fb5819a4854e4d863eba62d760fbc81c8a71de668cccf315bb32a854c035effede7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9f0f6ceeab84010ddf084ec3f628dc8

SHA1
c43ba23193ed2256264a6ea7d49554f9e668b6e1

SHA256
26146f47715987325726248a334dbc1f3a95fc1961978a184f77e5806f261f5d

SHA512
67d8e20cb12b0e14cb713e1a4fc00fb245158a6ba4ec8124dbd1d3eee73c6e3be18e55885df33a4ea39f7f89e18c98a73365ab226562686b817340ebfa688a86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7252fd5e89620bc35818da58109b9a3b

SHA1
4afb352b3fc2177578fbf413a03b62251131cfa8

SHA256
5b396f344d2855109b6aba42c095dfff63d0b36f9adbe8489fc216a142c7e003

SHA512
7ea7b303f268c3ab88d3d745f3aa7412179d729fce6b6c667ab507ffe98fad914819535a467d9f04013001c23dd6e47132f84597f848c07813463f730a044995

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
bb13e3ba7897a96ed41797ad00e427ea

SHA1
52a056f90fe79c47e2ff22b6119389fe89ad0c41

SHA256
fe5172eb297e0751342d1a42a49cbe04ad468cfb85e82700a3c8ae009f7c4c16

SHA512
2bbc7dc5c3ea1996619452b4817abfcf7aa4cd29a8e8af535d44a186d0895c8bb85a039ea581f86708dc197f9f3a3c2b1203b9a3c1274d5046bef50f1a9bbc38

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD6F1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD702.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.