Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

3

238137a251...18.exe

windows7-x64

1

238137a251...18.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    138s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/05/2024, 05:58 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    238137a25170644a26c8ee386c8e68a6_JaffaCakes118.exe

  • Size

    644KB

  • MD5

    238137a25170644a26c8ee386c8e68a6

  • SHA1

    8702554a5856a32c0f1e2fea62061300bf5e3fc4

  • SHA256

    17604ae531a89f4e51cf9f883cc4b20ac8e4ca2a984612088a68661c7de3f16d

  • SHA512

    3bd77cfa9b02694a5bcf2e55ef05ef004e1e73ea156f8ea4b56b37084bacfa6a969f0d3ef370b8062fed5809437100dcc5477b26a01682cf3ee15b90ea7c9eaa

  • SSDEEP

    12288:HEV/eHpTEQcwJ0m0NGBf9YxW1R7G39mssMet/bVDscyQ5Fa0WXE:0eHPXTYxWf7G39mssJpAY5Fa0WXE

Score
9/10
evasion

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\238137a25170644a26c8ee386c8e68a6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\238137a25170644a26c8ee386c8e68a6_JaffaCakes118.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks computer location settings
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3860
    • C:\Users\Admin\AppData\Local\Temp\n5558\s5558.exe
      "C:\Users\Admin\AppData\Local\Temp\n5558\s5558.exe" 979f03e451de7a78ac3000e1S/DNxNDdFe/wZe/0WIBm3BGuVUSCL3XaGQx0aL5n9Jo29E1hOLU4jlnfb4eiMvJZgGVXjIC8w4NzJUysm5djGGdoG/5rqKYfvSWg/GqZKTdi6HRcSSUBpwE91iytLXjFs1bm+XxzsJsK8KtNGqL3WQcckLxLch/ZBPld80FKnQ== /v "C:\Users\Admin\AppData\Local\Temp\238137a25170644a26c8ee386c8e68a6_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Drops file in Windows directory
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5060

Network

  • flag-us
    DNS
    149.220.183.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    149.220.183.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    crl.globalsign.net
    s5558.exe
    Remote address:
    8.8.8.8:53
    Request
    crl.globalsign.net
    IN A
    Response
    crl.globalsign.net
    IN CNAME
    global.prd.cdn.globalsign.com
    global.prd.cdn.globalsign.com
    IN CNAME
    cdn.globalsigncdn.com.cdn.cloudflare.net
    cdn.globalsigncdn.com.cdn.cloudflare.net
    IN A
    104.18.20.226
    cdn.globalsigncdn.com.cdn.cloudflare.net
    IN A
    104.18.21.226
  • flag-us
    GET
    http://crl.globalsign.net/root.crl
    s5558.exe
    Remote address:
    104.18.20.226:80
    Request
    GET /root.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: crl.globalsign.net
    Response
    HTTP/1.1 200 OK
    Date: Wed, 08 May 2024 05:58:55 GMT
    Content-Type: application/pkix-crl
    Content-Length: 1739
    Connection: keep-alive
    Last-Modified: Sun, 07 Apr 2024 00:00:00 GMT
    ETag: 5D
    Expires: Mon, 15 Jul 2024 00:00:00 GMT
    Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
    CF-Cache-Status: HIT
    Age: 2134
    Accept-Ranges: bytes
    Server: cloudflare
    CF-RAY: 88073882885476fc-LHR
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    226.20.18.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    226.20.18.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    23.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    bd5e3.northstar.api.socdn.com
    s5558.exe
    Remote address:
    8.8.8.8:53
    Request
    bd5e3.northstar.api.socdn.com
    IN A
    Response
    bd5e3.northstar.api.socdn.com
    IN CNAME
    615321.parkingcrew.net
    615321.parkingcrew.net
    IN A
    76.223.26.96
    615321.parkingcrew.net
    IN A
    13.248.148.254
  • flag-us
    GET
    http://bd5e3.northstar.api.socdn.com/installer/9450088c-7934-11e4-8a58-80c16e6f498c/13744595/config
    s5558.exe
    Remote address:
    76.223.26.96:80
    Request
    GET /installer/9450088c-7934-11e4-8a58-80c16e6f498c/13744595/config HTTP/1.1
    User-Agent: DownloadMR/3.1.40 (MSIE 9.11;Windows NT 6.3.9600.0;WOW64;.NET CLR 2.0.50727 SP2; .NET CLR 3.0 SP2; .NET CLR 3.5 SP1; .NET CLR 4; .NET CLR 4.0;m=B660M GAMING X DDR4;u=Admin;northstar;af27f449-eb08-a5f1-c1c2-cd4a5e39343d)
    Accept-Language: en-US
    Host: bd5e3.northstar.api.socdn.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Wed, 08 May 2024 05:58:59 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Server: nginx
    Vary: Accept-Encoding
    Vary: Accept-Encoding
    X-Redirect: skenzo
    X-Buckets: bucket102
    X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_n5FQA9SsLexOSMtWBxHoVkj2Pv0phneHqIrmdl6nHuejsMFGR58Y0io6DM2q6d4XVie/efQ3VDm/ad1WDMLrrA==
    X-Template: tpl_CleanPeppermintBlack_twoclick
    X-Language: english
    Accept-CH: viewport-width
    Accept-CH: dpr
    Accept-CH: device-memory
    Accept-CH: rtt
    Accept-CH: downlink
    Accept-CH: ect
    Accept-CH: ua
    Accept-CH: ua-full-version
    Accept-CH: ua-platform
    Accept-CH: ua-platform-version
    Accept-CH: ua-arch
    Accept-CH: ua-model
    Accept-CH: ua-mobile
    Accept-CH-Lifetime: 30
    X-Domain: socdn.com
    X-Subdomain: bd5e3.northstar.api
  • flag-us
    POST
    http://bd5e3.northstar.api.socdn.com/installer/9450088c-7934-11e4-8a58-80c16e6f498c/13744595/event
    s5558.exe
    Remote address:
    76.223.26.96:80
    Request
    POST /installer/9450088c-7934-11e4-8a58-80c16e6f498c/13744595/event HTTP/1.1
    User-Agent: DownloadMR/3.1.40 (MSIE 9.11;Windows NT 6.3.9600.0;WOW64;.NET CLR 2.0.50727 SP2; .NET CLR 3.0 SP2; .NET CLR 3.5 SP1; .NET CLR 4; .NET CLR 4.0;m=B660M GAMING X DDR4;u=Admin;northstar;af27f449-eb08-a5f1-c1c2-cd4a5e39343d)
    Accept-Language: en-US
    Content-Type: application/x-www-form-urlencoded
    Host: bd5e3.northstar.api.socdn.com
    Content-Length: 4116
    Expect: 100-continue
    Response
    HTTP/1.1 403 Forbidden
    Server: awselb/2.0
    Date: Wed, 08 May 2024 05:59:00 GMT
    Content-Type: text/html; charset=utf-8
    Content-Length: 138
    Connection: keep-alive
  • flag-us
    DNS
    96.26.223.76.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    96.26.223.76.in-addr.arpa
    IN PTR
    Response
    96.26.223.76.in-addr.arpa
    IN PTR
    aba1c1ff9d2ec5376awsglobalacceleratorcom
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    157.123.68.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    157.123.68.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    17.143.109.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    17.143.109.104.in-addr.arpa
    IN PTR
    Response
    17.143.109.104.in-addr.arpa
    IN PTR
    a104-109-143-17deploystaticakamaitechnologiescom
  • flag-us
    DNS
    0.205.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.205.248.87.in-addr.arpa
    IN PTR
    Response
    0.205.248.87.in-addr.arpa
    IN PTR
    https-87-248-205-0lgwllnwnet
  • flag-us
    DNS
    43.58.199.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.58.199.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    49.15.97.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    49.15.97.104.in-addr.arpa
    IN PTR
    Response
    49.15.97.104.in-addr.arpa
    IN PTR
    a104-97-15-49deploystaticakamaitechnologiescom
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 415458
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 4E405095634D4696979348E0E00EA73A Ref B: LON04EDGE0822 Ref C: 2024-05-08T06:00:39Z
    date: Wed, 08 May 2024 06:00:38 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360931611_1SOG5TNNJKE1WH1R0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239360931611_1SOG5TNNJKE1WH1R0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 555746
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: DD113CC12AE34D478FBA2F7541087F32 Ref B: LON04EDGE0822 Ref C: 2024-05-08T06:00:39Z
    date: Wed, 08 May 2024 06:00:38 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 621794
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 97AA12D7C5E84DA589A09A4BC6D2AA2F Ref B: LON04EDGE0822 Ref C: 2024-05-08T06:00:39Z
    date: Wed, 08 May 2024 06:00:38 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 430689
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 8854B1F6D4A142A9892DCFEEF21EACD3 Ref B: LON04EDGE0822 Ref C: 2024-05-08T06:00:39Z
    date: Wed, 08 May 2024 06:00:38 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340783933_1QOIM48UV8MGOV4SU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239340783933_1QOIM48UV8MGOV4SU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 638730
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: D375F570F6B94A77A50B8851F02CF4DD Ref B: LON04EDGE0822 Ref C: 2024-05-08T06:00:39Z
    date: Wed, 08 May 2024 06:00:38 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360931612_153L2SVWUYAQUME4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239360931612_153L2SVWUYAQUME4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 659775
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: A28400CFC66B4A9CBC4092D5B14D136F Ref B: LON04EDGE0822 Ref C: 2024-05-08T06:00:39Z
    date: Wed, 08 May 2024 06:00:39 GMT
  • flag-us
    DNS
    57.169.31.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    57.169.31.20.in-addr.arpa
    IN PTR
    Response
  • 104.18.20.226:80
    http://crl.globalsign.net/root.crl
    http
    s5558.exe
    357 B
     2.3kB
     5
    4

    HTTP Request

    GET http://crl.globalsign.net/root.crl

    HTTP Response

    200
  • 76.223.26.96:80
    http://bd5e3.northstar.api.socdn.com/installer/9450088c-7934-11e4-8a58-80c16e6f498c/13744595/event
    http
    s5558.exe
    5.5kB
     4.8kB
     12
    12

    HTTP Request

    GET http://bd5e3.northstar.api.socdn.com/installer/9450088c-7934-11e4-8a58-80c16e6f498c/13744595/config

    HTTP Response

    200

    HTTP Request

    POST http://bd5e3.northstar.api.socdn.com/installer/9450088c-7934-11e4-8a58-80c16e6f498c/13744595/event

    HTTP Response

    403
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.1kB
     16
    14
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.1kB
     16
    14
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.1kB
     16
    14
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239360931612_153L2SVWUYAQUME4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    tls, http2
    122.4kB
     3.4MB
     2508
    2503

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360931611_1SOG5TNNJKE1WH1R0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340783933_1QOIM48UV8MGOV4SU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360931612_153L2SVWUYAQUME4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Response

    200
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.1kB
     16
    14
  • 8.8.8.8:53
    149.220.183.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    149.220.183.52.in-addr.arpa

  • 8.8.8.8:53
    crl.globalsign.net
    dns
    s5558.exe
    64 B
     190 B
     1
    1

    DNS Request

    crl.globalsign.net

    DNS Response

    104.18.20.226
    104.18.21.226

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    226.20.18.104.in-addr.arpa
    dns
    72 B
     134 B
     1
    1

    DNS Request

    226.20.18.104.in-addr.arpa

  • 8.8.8.8:53
    23.159.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    23.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    bd5e3.northstar.api.socdn.com
    dns
    s5558.exe
    75 B
     143 B
     1
    1

    DNS Request

    bd5e3.northstar.api.socdn.com

    DNS Response

    76.223.26.96
    13.248.148.254

  • 8.8.8.8:53
    96.26.223.76.in-addr.arpa
    dns
    71 B
     127 B
     1
    1

    DNS Request

    96.26.223.76.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    157.123.68.40.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    157.123.68.40.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    17.143.109.104.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    17.143.109.104.in-addr.arpa

  • 8.8.8.8:53
    0.205.248.87.in-addr.arpa
    dns
    71 B
     116 B
     1
    1

    DNS Request

    0.205.248.87.in-addr.arpa

  • 8.8.8.8:53
    43.58.199.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    43.58.199.20.in-addr.arpa

  • 8.8.8.8:53
    49.15.97.104.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    49.15.97.104.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     173 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    57.169.31.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    57.169.31.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\n5558\s5558.exe
    Filesize

    350KB

    MD5

    d9491513f0befceaa26fac4af4001023

    SHA1

    68cb627c58d91ca68fb4eed9bb82b0510d91d7b3

    SHA256

    539c20c27359356dd6870052ebab461e9b6fe023087aa954c53f7987f0dab165

    SHA512

    566b993e85e837f37513129fc56401eec685effcc195b24b9f6266814c394f8e0c28f2eddc4562f4cfb8c9de7410cbb1a7544d97f469549ebcd4952b67f49cdb

    Download Submit

  • memory/5060-12-0x00007FFE05525000-0x00007FFE05526000-memory.dmp

    Filesize

    4KB

    Download

  • memory/5060-13-0x00007FFE05270000-0x00007FFE05C11000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/5060-22-0x000000001B340000-0x000000001B350000-memory.dmp

    Filesize

    64KB

    Download

  • memory/5060-25-0x000000001BBA0000-0x000000001C06E000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/5060-26-0x000000001C110000-0x000000001C1AC000-memory.dmp

    Filesize

    624KB

    Download

  • memory/5060-27-0x00007FFE05270000-0x00007FFE05C11000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/5060-28-0x000000001C550000-0x000000001C5B2000-memory.dmp

    Filesize

    392KB

    Download

  • memory/5060-29-0x00007FFE05270000-0x00007FFE05C11000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/5060-30-0x00007FFE05270000-0x00007FFE05C11000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/5060-31-0x000000001B360000-0x000000001B368000-memory.dmp

    Filesize

    32KB

    Download

  • memory/5060-32-0x00007FFE05270000-0x00007FFE05C11000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/5060-33-0x00007FFE05270000-0x00007FFE05C11000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/5060-34-0x00007FFE05270000-0x00007FFE05C11000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/5060-35-0x00007FFE05270000-0x00007FFE05C11000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/5060-36-0x000000001DEF0000-0x000000001E02C000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/5060-37-0x00000000200B0000-0x00000000205BE000-memory.dmp

    Filesize

    5.1MB

    Download

  • memory/5060-38-0x00007FFE05270000-0x00007FFE05C11000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/5060-39-0x00007FFE05270000-0x00007FFE05C11000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/5060-41-0x00007FFE05270000-0x00007FFE05C11000-memory.dmp

    Filesize

    9.6MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.