Analysis

  • max time kernel
    1396s
  • max time network
    1175s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231128-en
  • resource tags

    arch:x64arch:x86image:win11-20231128-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04-12-2023 17:56

General

  • Target

    The-MALWARE-Repo-master/Botnets/FritzFrog/5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59

  • Size

    8.7MB

  • MD5

    97cfb3c26a12e13792f7d1741309d767

  • SHA1

    a010f85cdda9f83cbc738eb1b41cd621f3d6018e

  • SHA256

    5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59

  • SHA512

    162028b9e93bb4718427304a96767880da7094c99ae6145e61a562f09dae0ce6726b2dfac95782990f50fa9bfc9f82b1aacb9e7b12442094137872fa8a3f3379

  • SSDEEP

    98304:yM1SkPCVk8rOmgYcGrr69gRQTI6xmiiLuSESStOAco7Xk:yM1SkPCVkIgcWAQ06xniLuSExR

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Botnets\FritzFrog\5fb29fb0136978b9ccf60750af09cec74a257a0ca9c47159ca74dbba21fbcc59
    1⤵
      PID:1496

    Network

    • flag-us
      DNS
      74.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      74.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      ocsp.digicert.com
      Remote address:
      8.8.8.8:53
      Request
      ocsp.digicert.com
      IN A
      Response
      ocsp.digicert.com
      IN CNAME
      ocsp.edge.digicert.com
      ocsp.edge.digicert.com
      IN CNAME
      fp2e7a.wpc.2be4.phicdn.net
      fp2e7a.wpc.2be4.phicdn.net
      IN CNAME
      fp2e7a.wpc.phicdn.net
      fp2e7a.wpc.phicdn.net
      IN A
      192.229.221.95
    • flag-us
      DNS
      arc.msn.com
      Remote address:
      8.8.8.8:53
      Request
      arc.msn.com
      IN A
      Response
      arc.msn.com
      IN CNAME
      arc.trafficmanager.net
      arc.trafficmanager.net
      IN CNAME
      iris-de-prod-azsc-v2-weu-b.westeurope.cloudapp.azure.com
      iris-de-prod-azsc-v2-weu-b.westeurope.cloudapp.azure.com
      IN A
      20.31.169.57
    • flag-us
      DNS
      nexusrules.officeapps.live.com
      Remote address:
      8.8.8.8:53
      Request
      nexusrules.officeapps.live.com
      IN A
      Response
      nexusrules.officeapps.live.com
      IN CNAME
      prod.nexusrules.live.com.akadns.net
      prod.nexusrules.live.com.akadns.net
      IN A
      52.111.236.23
    • flag-us
      DNS
      self.events.data.microsoft.com
      Remote address:
      8.8.8.8:53
      Request
      self.events.data.microsoft.com
      IN A
      Response
      self.events.data.microsoft.com
      IN CNAME
      self-events-data.trafficmanager.net
      self-events-data.trafficmanager.net
      IN CNAME
      onedscolprdeus07.eastus.cloudapp.azure.com
      onedscolprdeus07.eastus.cloudapp.azure.com
      IN A
      52.168.117.168
    • flag-us
      DNS
      80.14.97.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      80.14.97.104.in-addr.arpa
      IN PTR
      Response
      80.14.97.104.in-addr.arpa
      IN PTR
      a104-97-14-80deploystaticakamaitechnologiescom
    • flag-us
      DNS
      tse1.mm.bing.net
      Remote address:
      8.8.8.8:53
      Request
      tse1.mm.bing.net
      IN A
      Response
      tse1.mm.bing.net
      IN CNAME
      mm-mm.bing.net.trafficmanager.net
      mm-mm.bing.net.trafficmanager.net
      IN CNAME
      dual-a-0001.a-msedge.net
      dual-a-0001.a-msedge.net
      IN A
      204.79.197.200
      dual-a-0001.a-msedge.net
      IN A
      13.107.21.200
    • flag-us
      DNS
      81.14.97.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      81.14.97.104.in-addr.arpa
      IN PTR
      Response
      81.14.97.104.in-addr.arpa
      IN PTR
      a104-97-14-81deploystaticakamaitechnologiescom
    • flag-us
      DNS
      ctldl.windowsupdate.com
      Remote address:
      8.8.8.8:53
      Request
      ctldl.windowsupdate.com
      IN A
      Response
      ctldl.windowsupdate.com
      IN CNAME
      wu-bg-shim.trafficmanager.net
      wu-bg-shim.trafficmanager.net
      IN CNAME
      download.windowsupdate.com.edgesuite.net
      download.windowsupdate.com.edgesuite.net
      IN CNAME
      a767.dspw65.akamai.net
      a767.dspw65.akamai.net
      IN A
      104.97.14.80
      a767.dspw65.akamai.net
      IN A
      104.97.14.81
    • flag-us
      DNS
      arc.msn.com
      Remote address:
      8.8.8.8:53
      Request
      arc.msn.com
      IN A
      Response
      arc.msn.com
      IN CNAME
      arc.trafficmanager.net
      arc.trafficmanager.net
      IN CNAME
      iris-de-prod-azsc-v2-neu.northeurope.cloudapp.azure.com
      iris-de-prod-azsc-v2-neu.northeurope.cloudapp.azure.com
      IN A
      20.223.35.26
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317301464_1CE37Y0LCXUHN5MGE&pid=21.2&w=1080&h=1920&c=4
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239317301464_1CE37Y0LCXUHN5MGE&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.22000
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 370889
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: DF0BB2CA9234472B96E36ACB4E5BF6C0 Ref B: AMS04EDGE2920 Ref C: 2023-12-04T18:00:59Z
      date: Mon, 04 Dec 2023 18:00:59 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317301185_111IP3CQWIM3YFJP7&pid=21.2&w=1920&h=1080&c=4
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239317301185_111IP3CQWIM3YFJP7&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.22000
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 345904
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 9A6D968E2C5F46E880454E22ADC88865 Ref B: AMS04EDGE2920 Ref C: 2023-12-04T18:00:59Z
      date: Mon, 04 Dec 2023 18:00:59 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317301594_16P5W3HNTIETE3DL8&pid=21.2&w=1080&h=1920&c=4
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239317301594_16P5W3HNTIETE3DL8&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.22000
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 380848
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: DBC81AF69CB84893A29A503310FB2CFA Ref B: AMS04EDGE2920 Ref C: 2023-12-04T18:00:59Z
      date: Mon, 04 Dec 2023 18:00:59 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317301031_1USZWHXG9N9DXQDDC&pid=21.2&w=1920&h=1080&c=4
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239317301031_1USZWHXG9N9DXQDDC&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.22000
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 467039
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 0FF634DF32DE4A27B89602D878DABF88 Ref B: AMS04EDGE2920 Ref C: 2023-12-04T18:00:59Z
      date: Mon, 04 Dec 2023 18:00:59 GMT
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      1.3kB
      8.3kB
      16
      14
    • 204.79.197.200:443
      https://tse1.mm.bing.net/th?id=OADD2.10239317301031_1USZWHXG9N9DXQDDC&pid=21.2&w=1920&h=1080&c=4
      tls, http2
      55.3kB
      1.6MB
      1178
      1174

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317301464_1CE37Y0LCXUHN5MGE&pid=21.2&w=1080&h=1920&c=4

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317301185_111IP3CQWIM3YFJP7&pid=21.2&w=1920&h=1080&c=4

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317301594_16P5W3HNTIETE3DL8&pid=21.2&w=1080&h=1920&c=4

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317301031_1USZWHXG9N9DXQDDC&pid=21.2&w=1920&h=1080&c=4

      HTTP Response

      200

      HTTP Response

      200

      HTTP Response

      200

      HTTP Response

      200
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      1.3kB
      8.2kB
      16
      13
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      1.3kB
      8.3kB
      16
      14
    • 8.8.8.8:53
      74.32.126.40.in-addr.arpa
      dns
      343 B
      836 B
      5
      5

      DNS Request

      74.32.126.40.in-addr.arpa

      DNS Request

      ocsp.digicert.com

      DNS Response

      192.229.221.95

      DNS Request

      arc.msn.com

      DNS Response

      20.31.169.57

      DNS Request

      nexusrules.officeapps.live.com

      DNS Response

      52.111.236.23

      DNS Request

      self.events.data.microsoft.com

      DNS Response

      52.168.117.168

    • 8.8.8.8:53
      80.14.97.104.in-addr.arpa
      dns
      330 B
      846 B
      5
      5

      DNS Request

      80.14.97.104.in-addr.arpa

      DNS Request

      tse1.mm.bing.net

      DNS Response

      204.79.197.200
      13.107.21.200

      DNS Request

      81.14.97.104.in-addr.arpa

      DNS Request

      ctldl.windowsupdate.com

      DNS Response

      104.97.14.80
      104.97.14.81

      DNS Request

      arc.msn.com

      DNS Response

      20.223.35.26

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.