Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 14:36 UTC
Static task
static1
Behavioral task
behavioral1
Sample
c7b9da197598e00b681f0d76cc80e92f.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
c7b9da197598e00b681f0d76cc80e92f.html
Resource
win10v2004-20231215-en
General
-
Target
c7b9da197598e00b681f0d76cc80e92f.html
-
Size
1KB
-
MD5
c7b9da197598e00b681f0d76cc80e92f
-
SHA1
19c2222e902d772e9ee9535b574aa266aaa55bdc
-
SHA256
4fd5b554af28085c92d8840208d7f8b4b7740a40fecead6abf01db26abc597f4
-
SHA512
7a8359f0587dd19c62a3129870d4bbbfe623eb9fa24cc15ad34b80cefdbc1c6cfcce58811294aab6a6d4e8bb2c3e027c35f308e8b147f8beacbf97fcb50cf918
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000056c0f093da428f4099809f3dbcc1bfee000000000200000000001066000000010000200000003df2ea516ba0b142b7f84e873f93c15f97dc6787e921340215e94ea1d4dde6c6000000000e80000000020000200000007840838ad8389e084ac0f2ed73e4fcd6070d34102a41981a9606284f219c31e3200000000eae785def489ebcc54f9bf36a9bd0dce1a02cd2fbd98f7277d9929ca1be6dd040000000077fc2c645c6ac7a19c2f4824ba0097fd75a1b79d5d67f9e91261084d71d7c3b7f2dea4a00957bce3dcd5ab05e6c9889082bbc3200970d611a009333e73d391f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31077889" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410143200" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1696440169" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31077889" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8F8C1F60-A1F4-11EE-9BE3-4643CEF3E9DE} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1682533161" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31077889" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40914a580136da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1682533161" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2564 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2564 iexplore.exe 2564 iexplore.exe 3712 IEXPLORE.EXE 3712 IEXPLORE.EXE 3712 IEXPLORE.EXE 3712 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2564 wrote to memory of 3712 2564 iexplore.exe 87 PID 2564 wrote to memory of 3712 2564 iexplore.exe 87 PID 2564 wrote to memory of 3712 2564 iexplore.exe 87
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c7b9da197598e00b681f0d76cc80e92f.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2564 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3712
-
Network
-
Remote address:8.8.8.8:53Request74.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request2.136.104.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestfrookshop-winsive.comIN AResponsefrookshop-winsive.comIN A18.158.88.249
-
Remote address:8.8.8.8:53Requestfrookshop-winsive.comIN A
-
Remote address:8.8.8.8:53Requestfrookshop-winsive.comIN A
-
Remote address:8.8.8.8:53Requestfrookshop-winsive.comIN A
-
Remote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.a-0001.a-msedge.netg-bing-com.a-0001.a-msedge.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=c1a60025cc004fe2831475de1be39315&localId=w:09BE301F-AF04-8909-0529-ADD134954281&deviceId=6896190259413427&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=c1a60025cc004fe2831475de1be39315&localId=w:09BE301F-AF04-8909-0529-ADD134954281&deviceId=6896190259413427&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=0E767217EB0B668417EE61E6EAEB6700; domain=.bing.com; expires=Fri, 17-Jan-2025 00:37:12 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8892049EC13449989B82FE7FE073A871 Ref B: LON04EDGE1122 Ref C: 2023-12-24T00:37:12Z
date: Sun, 24 Dec 2023 00:37:12 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=c1a60025cc004fe2831475de1be39315&localId=w:09BE301F-AF04-8909-0529-ADD134954281&deviceId=6896190259413427&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=c1a60025cc004fe2831475de1be39315&localId=w:09BE301F-AF04-8909-0529-ADD134954281&deviceId=6896190259413427&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=0E767217EB0B668417EE61E6EAEB6700
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=FgpGGhgHTS8jWDb8MagPnlejVX9D8bsFsCPHgKqTG4w; domain=.bing.com; expires=Fri, 17-Jan-2025 00:37:13 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6DF72204E5714E0AB0ABCB16AA51DE9B Ref B: LON04EDGE1122 Ref C: 2023-12-24T00:37:13Z
date: Sun, 24 Dec 2023 00:37:13 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=c1a60025cc004fe2831475de1be39315&localId=w:09BE301F-AF04-8909-0529-ADD134954281&deviceId=6896190259413427&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=c1a60025cc004fe2831475de1be39315&localId=w:09BE301F-AF04-8909-0529-ADD134954281&deviceId=6896190259413427&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=0E767217EB0B668417EE61E6EAEB6700; MSPTC=FgpGGhgHTS8jWDb8MagPnlejVX9D8bsFsCPHgKqTG4w
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 30E19D28A2F34488A0EF6DBEE30F0304 Ref B: LON04EDGE1122 Ref C: 2023-12-24T00:37:13Z
date: Sun, 24 Dec 2023 00:37:13 GMT
-
Remote address:8.8.8.8:53Request43.58.199.20.in-addr.arpaIN PTRResponse
-
GEThttps://frookshop-winsive.com/redirect?target=BASE64aHR0cHM6Ly93My5kbnN2aWJlcy5jby8_dXRtX21lZGl1bT00MWIxMzFiYWI4ZWZhZDVmMThiMDI5NWM5ZGI0OTBiNTVkMTU3ZGUyJnV0bV9jYW1wYWlnbj1pbWFnaW5lYWRzIHNtYXJsdGluayBhZ2dyZXNpdmUgbmV3IDIwMTkmY2lkPXduZjVxdHJpbWpwbjBvYmEycXY3aHA3dSYxPWI1OTg0MWIxLWNkOGMtNGIwMS04NGYzLTNmNDAwOTJhMmQ0NA&ts=1631146927678&hash=dwB2vH2LIA922OgjSQYW5FD_4ErDbHgmpI9tzR48tpY&rm=DJIEXPLORE.EXERemote address:18.158.88.249:443RequestGET /redirect?target=BASE64aHR0cHM6Ly93My5kbnN2aWJlcy5jby8_dXRtX21lZGl1bT00MWIxMzFiYWI4ZWZhZDVmMThiMDI5NWM5ZGI0OTBiNTVkMTU3ZGUyJnV0bV9jYW1wYWlnbj1pbWFnaW5lYWRzIHNtYXJsdGluayBhZ2dyZXNpdmUgbmV3IDIwMTkmY2lkPXduZjVxdHJpbWpwbjBvYmEycXY3aHA3dSYxPWI1OTg0MWIxLWNkOGMtNGIwMS04NGYzLTNmNDAwOTJhMmQ0NA&ts=1631146927678&hash=dwB2vH2LIA922OgjSQYW5FD_4ErDbHgmpI9tzR48tpY&rm=DJ HTTP/2.0
host: frookshop-winsive.com
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate
ResponseHTTP/2.0 400
date: Sun, 24 Dec 2023 00:37:17 GMT
content-type: text/html
content-length: 231
cache-control: no-store, no-cache, pre-check=0, post-check=0
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
-
Remote address:8.8.8.8:53Request249.88.158.18.in-addr.arpaIN PTRResponse249.88.158.18.in-addr.arpaIN PTRec2-18-158-88-249eu-central-1compute amazonawscom
-
Remote address:8.8.8.8:53Request249.88.158.18.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request32.169.19.2.in-addr.arpaIN PTRResponse32.169.19.2.in-addr.arpaIN PTRa2-19-169-32deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request41.110.16.96.in-addr.arpaIN PTRResponse41.110.16.96.in-addr.arpaIN PTRa96-16-110-41deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request208.194.73.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request100.5.17.2.in-addr.arpaIN PTRResponse100.5.17.2.in-addr.arpaIN PTRa2-17-5-100deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request119.110.54.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request161.19.199.152.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request161.19.199.152.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTRResponse18.134.221.88.in-addr.arpaIN PTRa88-221-134-18deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN A
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301292_1GDVMD25ARDBL3246&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301292_1GDVMD25ARDBL3246&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 471518
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 5658BFC588464FDEA0DD9301F71404F1 Ref B: LON04EDGE0815 Ref C: 2023-12-24T00:37:51Z
date: Sun, 24 Dec 2023 00:37:51 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301608_1VIRGE9SQGF5A77JM&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301608_1VIRGE9SQGF5A77JM&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 220516
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9056D6FE87EE47EAA92B0F696E4E9C58 Ref B: LON04EDGE0815 Ref C: 2023-12-24T00:37:51Z
date: Sun, 24 Dec 2023 00:37:51 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301701_11UGRWY4Y5ZEF3873&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301701_11UGRWY4Y5ZEF3873&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 242979
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DA7F7F43CDF24409BC9022EB7ED7426A Ref B: LON04EDGE0815 Ref C: 2023-12-24T00:37:51Z
date: Sun, 24 Dec 2023 00:37:51 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301199_1N7DT3DN40PC8RCSP&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301199_1N7DT3DN40PC8RCSP&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 589227
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: AF16A5CE6FF94EA08673CC017E51F6A7 Ref B: LON04EDGE0815 Ref C: 2023-12-24T00:37:52Z
date: Sun, 24 Dec 2023 00:37:52 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301300_1W5IDSAF7QNUPAKJA&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301300_1W5IDSAF7QNUPAKJA&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 310886
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 78D885354C914A09A0800B84CFD97BD7 Ref B: LON04EDGE0815 Ref C: 2023-12-24T00:37:52Z
date: Sun, 24 Dec 2023 00:37:52 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301709_1C1YA1WEBYCDCSS07&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301709_1C1YA1WEBYCDCSS07&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 284334
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6B95F0FD892E4BAC859186F9C21593D7 Ref B: LON04EDGE0815 Ref C: 2023-12-24T00:37:59Z
date: Sun, 24 Dec 2023 00:37:59 GMT
-
Remote address:8.8.8.8:53Request176.178.17.96.in-addr.arpaIN PTRResponse176.178.17.96.in-addr.arpaIN PTRa96-17-178-176deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request32.134.221.88.in-addr.arpaIN PTRResponse32.134.221.88.in-addr.arpaIN PTRa88-221-134-32deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request217.135.221.88.in-addr.arpaIN PTRResponse217.135.221.88.in-addr.arpaIN PTRa88-221-135-217deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request174.178.17.96.in-addr.arpaIN PTRResponse174.178.17.96.in-addr.arpaIN PTRa96-17-178-174deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request180.178.17.96.in-addr.arpaIN PTRResponse180.178.17.96.in-addr.arpaIN PTRa96-17-178-180deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request12.173.189.20.in-addr.arpaIN PTRResponse
-
204.79.197.200:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=c1a60025cc004fe2831475de1be39315&localId=w:09BE301F-AF04-8909-0529-ADD134954281&deviceId=6896190259413427&anid=tls, http22.4kB 9.3kB 20 15
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=c1a60025cc004fe2831475de1be39315&localId=w:09BE301F-AF04-8909-0529-ADD134954281&deviceId=6896190259413427&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=c1a60025cc004fe2831475de1be39315&localId=w:09BE301F-AF04-8909-0529-ADD134954281&deviceId=6896190259413427&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=c1a60025cc004fe2831475de1be39315&localId=w:09BE301F-AF04-8909-0529-ADD134954281&deviceId=6896190259413427&anid=HTTP Response
204 -
18.158.88.249:443https://frookshop-winsive.com/redirect?target=BASE64aHR0cHM6Ly93My5kbnN2aWJlcy5jby8_dXRtX21lZGl1bT00MWIxMzFiYWI4ZWZhZDVmMThiMDI5NWM5ZGI0OTBiNTVkMTU3ZGUyJnV0bV9jYW1wYWlnbj1pbWFnaW5lYWRzIHNtYXJsdGluayBhZ2dyZXNpdmUgbmV3IDIwMTkmY2lkPXduZjVxdHJpbWpwbjBvYmEycXY3aHA3dSYxPWI1OTg0MWIxLWNkOGMtNGIwMS04NGYzLTNmNDAwOTJhMmQ0NA&ts=1631146927678&hash=dwB2vH2LIA922OgjSQYW5FD_4ErDbHgmpI9tzR48tpY&rm=DJtls, http2IEXPLORE.EXE2.1kB 7.2kB 22 16
HTTP Request
GET https://frookshop-winsive.com/redirect?target=BASE64aHR0cHM6Ly93My5kbnN2aWJlcy5jby8_dXRtX21lZGl1bT00MWIxMzFiYWI4ZWZhZDVmMThiMDI5NWM5ZGI0OTBiNTVkMTU3ZGUyJnV0bV9jYW1wYWlnbj1pbWFnaW5lYWRzIHNtYXJsdGluayBhZ2dyZXNpdmUgbmV3IDIwMTkmY2lkPXduZjVxdHJpbWpwbjBvYmEycXY3aHA3dSYxPWI1OTg0MWIxLWNkOGMtNGIwMS04NGYzLTNmNDAwOTJhMmQ0NA&ts=1631146927678&hash=dwB2vH2LIA922OgjSQYW5FD_4ErDbHgmpI9tzR48tpY&rm=DJHTTP Response
400 -
1.7kB 5.9kB 19 15
-
1.3kB 8.3kB 17 14
-
1.2kB 8.3kB 16 14
-
204.79.197.200:443https://tse1.mm.bing.net/th?id=OADD2.10239317301709_1C1YA1WEBYCDCSS07&pid=21.2&w=1080&h=1920&c=4tls, http281.2kB 2.2MB 1615 1609
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301292_1GDVMD25ARDBL3246&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301608_1VIRGE9SQGF5A77JM&pid=21.2&w=1080&h=1920&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301701_11UGRWY4Y5ZEF3873&pid=21.2&w=1080&h=1920&c=4HTTP Response
200HTTP Response
200HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301199_1N7DT3DN40PC8RCSP&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301300_1W5IDSAF7QNUPAKJA&pid=21.2&w=1920&h=1080&c=4HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301709_1C1YA1WEBYCDCSS07&pid=21.2&w=1080&h=1920&c=4HTTP Response
200HTTP Response
200 -
1.2kB 9.7kB 16 15
-
-
71 B 157 B 1 1
DNS Request
74.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
240.221.184.93.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
2.136.104.51.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
268 B 83 B 4 1
DNS Request
frookshop-winsive.com
DNS Request
frookshop-winsive.com
DNS Request
frookshop-winsive.com
DNS Request
frookshop-winsive.com
DNS Response
18.158.88.249
-
70 B 156 B 1 1
DNS Request
9.228.82.20.in-addr.arpa
-
56 B 158 B 1 1
DNS Request
g.bing.com
DNS Response
204.79.197.20013.107.21.200
-
71 B 157 B 1 1
DNS Request
43.58.199.20.in-addr.arpa
-
144 B 138 B 2 1
DNS Request
249.88.158.18.in-addr.arpa
DNS Request
249.88.158.18.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
32.169.19.2.in-addr.arpa
-
140 B 156 B 2 1
DNS Request
50.23.12.20.in-addr.arpa
DNS Request
50.23.12.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
41.110.16.96.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
208.194.73.20.in-addr.arpa
-
144 B 158 B 2 1
DNS Request
171.39.242.20.in-addr.arpa
DNS Request
171.39.242.20.in-addr.arpa
-
69 B 131 B 1 1
DNS Request
100.5.17.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
119.110.54.20.in-addr.arpa
-
146 B 144 B 2 1
DNS Request
161.19.199.152.in-addr.arpa
DNS Request
161.19.199.152.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
18.134.221.88.in-addr.arpa
-
124 B 173 B 2 1
DNS Request
tse1.mm.bing.net
DNS Request
tse1.mm.bing.net
DNS Response
204.79.197.20013.107.21.200
-
72 B 137 B 1 1
DNS Request
176.178.17.96.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
32.134.221.88.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
217.135.221.88.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
174.178.17.96.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
180.178.17.96.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
12.173.189.20.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee