Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

dfcd526e2c...29.exe

windows7-x64

7

dfcd526e2c...29.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    146s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/03/2024, 18:20 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dfcd526e2c140557a1771307827c4529.exe

  • Size

    302KB

  • MD5

    dfcd526e2c140557a1771307827c4529

  • SHA1

    48a75d9b11137d9e9f3d426995baeb13a3ec4d15

  • SHA256

    ac5589d2a0feadefa6e65451e2b6a84ce20d97d377551f8115142a5e39ccbbf9

  • SHA512

    eee825f83a623533fc9723633d670e3486043ec25f7a9b722d7e9ec364ce6981449a83fc2b95074baccdde3b53ff301668f271c942ec339c42c77d1cc7e3509e

  • SSDEEP

    3072:woukSeYe7+72v5aACE/+IDoQ+nFHSqU2yfc5rE0cG/L4MGHo7M0rk8N1uTYOB419:wql7CG2aX+3qkBX0zI7Mc4/q7jHsmQ

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dfcd526e2c140557a1771307827c4529.exe
    "C:\Users\Admin\AppData\Local\Temp\dfcd526e2c140557a1771307827c4529.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2252
    • C:\Users\Admin\AppData\Local\Temp\dfcd526e2c140557a1771307827c4529.exe
      C:\Users\Admin\AppData\Local\Temp\dfcd526e2c140557a1771307827c4529.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:4644

Network

  • flag-us
    DNS
    140.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    140.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.154.82.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.154.82.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.154.82.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.154.82.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    cutit.org
    dfcd526e2c140557a1771307827c4529.exe
    Remote address:
    8.8.8.8:53
    Request
    cutit.org
    IN A
    Response
    cutit.org
    IN A
    64.91.240.248
  • flag-us
    GET
    https://cutit.org/oxgBR
    dfcd526e2c140557a1771307827c4529.exe
    Remote address:
    64.91.240.248:443
    Request
    GET /oxgBR HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
    Host: cutit.org
    Cache-Control: no-cache
    Response
    HTTP/1.1 302 Moved Temporarily
    Date: Tue, 26 Mar 2024 18:20:50 GMT
    Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9
    X-Powered-By: PHP/5.4.16
    Connection: close
    Cache-Control: no-cache
    Pragma: no-cache
    Location: http://ww7.cutit.org/oxgBR?usid=25&utid=6160600264
    Content-Length: 0
    Content-Type: text/html; charset=UTF-8
  • flag-us
    DNS
    19.179.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    19.179.17.96.in-addr.arpa
    IN PTR
    Response
    19.179.17.96.in-addr.arpa
    IN PTR
    a96-17-179-19deploystaticakamaitechnologiescom
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.a-0001.a-msedge.net
    g-bing-com.a-0001.a-msedge.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=e69984a5071d4d0eb47919cea0e9bce9&localId=w:2EBBC17B-F2BF-CBA4-B0F0-4BC5BF6536CE&deviceId=6755461004769679&anid=
    Remote address:
    204.79.197.200:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=e69984a5071d4d0eb47919cea0e9bce9&localId=w:2EBBC17B-F2BF-CBA4-B0F0-4BC5BF6536CE&deviceId=6755461004769679&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=1BB89FA6BE90648C14508BE8BFB76554; domain=.bing.com; expires=Sun, 20-Apr-2025 18:20:47 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 6875D49997C9483A8E1F9F7EDC1B4220 Ref B: LON04EDGE0719 Ref C: 2024-03-26T18:20:47Z
    date: Tue, 26 Mar 2024 18:20:46 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=e69984a5071d4d0eb47919cea0e9bce9&localId=w:2EBBC17B-F2BF-CBA4-B0F0-4BC5BF6536CE&deviceId=6755461004769679&anid=
    Remote address:
    204.79.197.200:443
    Request
    GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=e69984a5071d4d0eb47919cea0e9bce9&localId=w:2EBBC17B-F2BF-CBA4-B0F0-4BC5BF6536CE&deviceId=6755461004769679&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=1BB89FA6BE90648C14508BE8BFB76554
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=0kUoMAY1Gtf6Ku-GRP0UrXMYGF_delkfFxKzbcIXbjM; domain=.bing.com; expires=Sun, 20-Apr-2025 18:20:47 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: ECFE175765044058A6018693DF2D21B4 Ref B: LON04EDGE0719 Ref C: 2024-03-26T18:20:47Z
    date: Tue, 26 Mar 2024 18:20:47 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=e69984a5071d4d0eb47919cea0e9bce9&localId=w:2EBBC17B-F2BF-CBA4-B0F0-4BC5BF6536CE&deviceId=6755461004769679&anid=
    Remote address:
    204.79.197.200:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=e69984a5071d4d0eb47919cea0e9bce9&localId=w:2EBBC17B-F2BF-CBA4-B0F0-4BC5BF6536CE&deviceId=6755461004769679&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=1BB89FA6BE90648C14508BE8BFB76554; MSPTC=0kUoMAY1Gtf6Ku-GRP0UrXMYGF_delkfFxKzbcIXbjM
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 33FF41BC5AC54D82B53FB9E0D7AB0FB3 Ref B: LON04EDGE0719 Ref C: 2024-03-26T18:20:48Z
    date: Tue, 26 Mar 2024 18:20:47 GMT
  • flag-us
    DNS
    248.240.91.64.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    248.240.91.64.in-addr.arpa
    IN PTR
    Response
    248.240.91.64.in-addr.arpa
    IN PTR
    crocodile parklogiccom
  • flag-us
    DNS
    41.110.16.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    41.110.16.96.in-addr.arpa
    IN PTR
    Response
    41.110.16.96.in-addr.arpa
    IN PTR
    a96-16-110-41deploystaticakamaitechnologiescom
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    40.13.222.173.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    40.13.222.173.in-addr.arpa
    IN PTR
    Response
    40.13.222.173.in-addr.arpa
    IN PTR
    a173-222-13-40deploystaticakamaitechnologiescom
  • flag-us
    DNS
    40.13.222.173.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    40.13.222.173.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    201.179.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    201.179.17.96.in-addr.arpa
    IN PTR
    Response
    201.179.17.96.in-addr.arpa
    IN PTR
    a96-17-179-201deploystaticakamaitechnologiescom
  • flag-us
    DNS
    ww7.cutit.org
    dfcd526e2c140557a1771307827c4529.exe
    Remote address:
    8.8.8.8:53
    Request
    ww7.cutit.org
    IN A
    Response
    ww7.cutit.org
    IN CNAME
    78626.bodis.com
    78626.bodis.com
    IN A
    199.59.243.225
  • flag-us
    GET
    http://ww7.cutit.org/oxgBR?usid=25&utid=6160600264
    dfcd526e2c140557a1771307827c4529.exe
    Remote address:
    199.59.243.225:80
    Request
    GET /oxgBR?usid=25&utid=6160600264 HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
    Cache-Control: no-cache
    Host: ww7.cutit.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    date: Tue, 26 Mar 2024 18:20:50 GMT
    content-type: text/html; charset=utf-8
    content-length: 1126
    x-request-id: ef1c8144-3e82-4a15-82ed-db9b82e8350c
    cache-control: no-store, max-age=0
    accept-ch: sec-ch-prefers-color-scheme
    critical-ch: sec-ch-prefers-color-scheme
    vary: sec-ch-prefers-color-scheme
    x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_zfm5HaPGOSQdNOYrQIvobsP6BD/lLfNMKRf5HNHfGPywcCPeJ2EN7yAP0cvC8gEFqwDW2LxqlcMiHY8YwBJSQw==
    set-cookie: parking_session=ef1c8144-3e82-4a15-82ed-db9b82e8350c; expires=Tue, 26 Mar 2024 18:35:50 GMT; path=/
  • flag-us
    DNS
    225.243.59.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    225.243.59.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    157.123.68.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    157.123.68.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    140.71.91.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    140.71.91.104.in-addr.arpa
    IN PTR
    Response
    140.71.91.104.in-addr.arpa
    IN PTR
    a104-91-71-140deploystaticakamaitechnologiescom
  • flag-us
    DNS
    34.56.20.217.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    34.56.20.217.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    34.56.20.217.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    34.56.20.217.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    22.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    22.236.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239339388278_1W86NLV8P5MKR64KJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239339388278_1W86NLV8P5MKR64KJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 653498
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: DDB4525E0D894B3EACBA64B176236147 Ref B: LON04EDGE0717 Ref C: 2024-03-26T18:22:33Z
    date: Tue, 26 Mar 2024 18:22:33 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340418552_1AAPCBWXWYRQF23F9&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239340418552_1AAPCBWXWYRQF23F9&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 522409
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 9ECC963CFE4A455E93E0E4FCABB75F68 Ref B: LON04EDGE0717 Ref C: 2024-03-26T18:22:33Z
    date: Tue, 26 Mar 2024 18:22:33 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340418551_1MWHJRW59UCHVWKN4&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239340418551_1MWHJRW59UCHVWKN4&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 534196
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 0C7200DB69774F56AB076F9D34C25076 Ref B: LON04EDGE0717 Ref C: 2024-03-26T18:22:34Z
    date: Tue, 26 Mar 2024 18:22:34 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301236_1F0R8LNJXXE73BCIY&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301236_1F0R8LNJXXE73BCIY&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 635759
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: E97D4C5A8A014130BEF0129279C5C23F Ref B: LON04EDGE0717 Ref C: 2024-03-26T18:22:34Z
    date: Tue, 26 Mar 2024 18:22:34 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301645_1DQ842AA5KWZY6AM7&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301645_1DQ842AA5KWZY6AM7&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239339388279_1UYY86N8YUHVHXK2Q&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239339388279_1UYY86N8YUHVHXK2Q&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
  • flag-us
    DNS
    214.80.50.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    214.80.50.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    214.80.50.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    214.80.50.20.in-addr.arpa
    IN PTR
  • 64.91.240.248:443
    https://cutit.org/oxgBR
    tls, http
    dfcd526e2c140557a1771307827c4529.exe
    1.3kB
     3.9kB
     16
    12

    HTTP Request

    GET https://cutit.org/oxgBR

    HTTP Response

    302
  • 204.79.197.200:443
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=e69984a5071d4d0eb47919cea0e9bce9&localId=w:2EBBC17B-F2BF-CBA4-B0F0-4BC5BF6536CE&deviceId=6755461004769679&anid=
    tls, http2
    1.9kB
     9.2kB
     19
    17

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=e69984a5071d4d0eb47919cea0e9bce9&localId=w:2EBBC17B-F2BF-CBA4-B0F0-4BC5BF6536CE&deviceId=6755461004769679&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=e69984a5071d4d0eb47919cea0e9bce9&localId=w:2EBBC17B-F2BF-CBA4-B0F0-4BC5BF6536CE&deviceId=6755461004769679&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=e69984a5071d4d0eb47919cea0e9bce9&localId=w:2EBBC17B-F2BF-CBA4-B0F0-4BC5BF6536CE&deviceId=6755461004769679&anid=

    HTTP Response

    204
  • 199.59.243.225:80
    http://ww7.cutit.org/oxgBR?usid=25&utid=6160600264
    http
    dfcd526e2c140557a1771307827c4529.exe
    859 B
     2.6kB
     14
    6

    HTTP Request

    GET http://ww7.cutit.org/oxgBR?usid=25&utid=6160600264

    HTTP Response

    200
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    2.0kB
     9.5kB
     20
    15
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    2.0kB
     9.5kB
     20
    15
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    2.0kB
     9.5kB
     20
    15
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239339388279_1UYY86N8YUHVHXK2Q&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    tls, http2
    81.6kB
     2.3MB
     1703
    1692

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239339388278_1W86NLV8P5MKR64KJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418552_1AAPCBWXWYRQF23F9&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418551_1MWHJRW59UCHVWKN4&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301236_1F0R8LNJXXE73BCIY&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301645_1DQ842AA5KWZY6AM7&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239339388279_1UYY86N8YUHVHXK2Q&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.1kB
     15
    14
  • 8.8.8.8:53
    140.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    140.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    241.154.82.20.in-addr.arpa
    dns
    144 B
     158 B
     2
    1

    DNS Request

    241.154.82.20.in-addr.arpa

    DNS Request

    241.154.82.20.in-addr.arpa

  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    146 B
     147 B
     2
    1

    DNS Request

    133.211.185.52.in-addr.arpa

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    cutit.org
    dns
    dfcd526e2c140557a1771307827c4529.exe
    55 B
     71 B
     1
    1

    DNS Request

    cutit.org

    DNS Response

    64.91.240.248

  • 8.8.8.8:53
    19.179.17.96.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    19.179.17.96.in-addr.arpa

  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     158 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    248.240.91.64.in-addr.arpa
    dns
    72 B
     109 B
     1
    1

    DNS Request

    248.240.91.64.in-addr.arpa

  • 8.8.8.8:53
    41.110.16.96.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    41.110.16.96.in-addr.arpa

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
     106 B
     1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    88.156.103.20.in-addr.arpa
    dns
    144 B
     158 B
     2
    1

    DNS Request

    88.156.103.20.in-addr.arpa

    DNS Request

    88.156.103.20.in-addr.arpa

  • 8.8.8.8:53
    40.13.222.173.in-addr.arpa
    dns
    144 B
     137 B
     2
    1

    DNS Request

    40.13.222.173.in-addr.arpa

    DNS Request

    40.13.222.173.in-addr.arpa

  • 8.8.8.8:53
    201.179.17.96.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    201.179.17.96.in-addr.arpa

  • 8.8.8.8:53
    ww7.cutit.org
    dns
    dfcd526e2c140557a1771307827c4529.exe
    59 B
     104 B
     1
    1

    DNS Request

    ww7.cutit.org

    DNS Response

    199.59.243.225

  • 8.8.8.8:53
    225.243.59.199.in-addr.arpa
    dns
    73 B
     131 B
     1
    1

    DNS Request

    225.243.59.199.in-addr.arpa

  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    157.123.68.40.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    157.123.68.40.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    140.71.91.104.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    140.71.91.104.in-addr.arpa

  • 8.8.8.8:53
    34.56.20.217.in-addr.arpa
    dns
    142 B
     131 B
     2
    1

    DNS Request

    34.56.20.217.in-addr.arpa

    DNS Request

    34.56.20.217.in-addr.arpa

  • 8.8.8.8:53
    22.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    22.236.111.52.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    124 B
     173 B
     2
    1

    DNS Request

    tse1.mm.bing.net

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    214.80.50.20.in-addr.arpa
    dns
    142 B
     157 B
     2
    1

    DNS Request

    214.80.50.20.in-addr.arpa

    DNS Request

    214.80.50.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\dfcd526e2c140557a1771307827c4529.exe
    Filesize

    302KB

    MD5

    7bbac56288a1809a7288051bf090f272

    SHA1

    df41a57d0b6385dbc7d2f28633d8238305b23123

    SHA256

    ab05a38a35fb0c99f54bfe5676fd6e7d0f414763ece25079a8b7426c5df2d0d3

    SHA512

    7eaa59f0e8e3cab25e74ae3868a78d1d8ba09d5cb7d76e47e699ae8337a682aa6eb56f46543129639b3de4e273b45067b07eebb4e55a1619ced49eed97c1a49c

    Download Submit

  • memory/2252-0-0x0000000000400000-0x00000000004E0000-memory.dmp

    Filesize

    896KB

    Download

  • memory/2252-1-0x0000000000140000-0x0000000000171000-memory.dmp

    Filesize

    196KB

    Download

  • memory/2252-2-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/2252-13-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/4644-14-0x0000000000400000-0x00000000004E0000-memory.dmp

    Filesize

    896KB

    Download

  • memory/4644-16-0x00000000014E0000-0x0000000001511000-memory.dmp

    Filesize

    196KB

    Download

  • memory/4644-30-0x0000000000400000-0x00000000004E0000-memory.dmp

    Filesize

    896KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.