Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

1

47d518309a...18.exe

windows7-x64

6

47d518309a...18.exe

windows10-2004-x64

4

Analysis

  • max time kernel
    130s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/05/2024, 20:12 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    47d518309a5fc18bd56ddd1172c0b9f1_JaffaCakes118.exe

  • Size

    285KB

  • MD5

    47d518309a5fc18bd56ddd1172c0b9f1

  • SHA1

    5de985d66c6b668a7c97b018992372c92a39207f

  • SHA256

    2320cb8b95b20102282f070f9d8b4f520834a5cf2cbfb50935b6436a0f171af8

  • SHA512

    c437a30d2cbf2b74ebf53606814ce1bc6f8401360c8363876d5654f95d295f210eb8cd2df8ba0a8163c47f6d2423141cc8e069057fc462a46ef802bbc7d21698

  • SSDEEP

    3072:Tqes/Klzs/JNRjoX1XdqGEi69tH+ZcMek1sDZYf5RGxkf757hq2zg/zOZci:Tq3F/JNRjS20MtH+ZcMoKWqx1g/aZf

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\47d518309a5fc18bd56ddd1172c0b9f1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\47d518309a5fc18bd56ddd1172c0b9f1_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    PID:4252

Network

  • flag-us
    DNS
    first-usapro.info
    47d518309a5fc18bd56ddd1172c0b9f1_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    first-usapro.info
    IN A
    Response
  • flag-us
    DNS
    get-bluesee.info
    47d518309a5fc18bd56ddd1172c0b9f1_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    get-bluesee.info
    IN A
    Response
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    center-ring.info
    47d518309a5fc18bd56ddd1172c0b9f1_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    center-ring.info
    IN A
    Response
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.dual-a-0034.a-msedge.net
    g-bing-com.dual-a-0034.a-msedge.net
    IN CNAME
    dual-a-0034.a-msedge.net
    dual-a-0034.a-msedge.net
    IN A
    204.79.197.237
    dual-a-0034.a-msedge.net
    IN A
    13.107.21.237
  • flag-us
    GET
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De89zHxmknVAgRMxVosanPnUzVUCUzGQRGaUmY9uhbv-4hVumDOqGAR78A94RZwix2Akxhfc1tSafdw8tfRYZ2ufsyY_2wAZFnmirC3RtUE60DnGw7a4Y8hKHzCaIgobpqPUjKGg43L1gMFZbWBWMsiiumsHRZpxjl_fvA_hbd7VVnfUvQd%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D9df59487a22f18150b86f2ac0a2edaa5&TIME=20240426T131201Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:ADDDFB3E-F7AA-0DA8-A496-4D397794E5DF&deviceId=6896200621815266&muid=ADDDFB3EF7AA0DA8A4964D397794E5DF
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De89zHxmknVAgRMxVosanPnUzVUCUzGQRGaUmY9uhbv-4hVumDOqGAR78A94RZwix2Akxhfc1tSafdw8tfRYZ2ufsyY_2wAZFnmirC3RtUE60DnGw7a4Y8hKHzCaIgobpqPUjKGg43L1gMFZbWBWMsiiumsHRZpxjl_fvA_hbd7VVnfUvQd%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D9df59487a22f18150b86f2ac0a2edaa5&TIME=20240426T131201Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:ADDDFB3E-F7AA-0DA8-A496-4D397794E5DF&deviceId=6896200621815266&muid=ADDDFB3EF7AA0DA8A4964D397794E5DF HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=1587A58F595C6BA93A47B10F58E76A70; domain=.bing.com; expires=Mon, 09-Jun-2025 20:12:14 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 558D3584430D4901A440F9A6FDB42FFC Ref B: LON04EDGE0822 Ref C: 2024-05-15T20:12:14Z
    date: Wed, 15 May 2024 20:12:14 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De89zHxmknVAgRMxVosanPnUzVUCUzGQRGaUmY9uhbv-4hVumDOqGAR78A94RZwix2Akxhfc1tSafdw8tfRYZ2ufsyY_2wAZFnmirC3RtUE60DnGw7a4Y8hKHzCaIgobpqPUjKGg43L1gMFZbWBWMsiiumsHRZpxjl_fvA_hbd7VVnfUvQd%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D9df59487a22f18150b86f2ac0a2edaa5&TIME=20240426T131201Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:ADDDFB3E-F7AA-0DA8-A496-4D397794E5DF&deviceId=6896200621815266&muid=ADDDFB3EF7AA0DA8A4964D397794E5DF
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De89zHxmknVAgRMxVosanPnUzVUCUzGQRGaUmY9uhbv-4hVumDOqGAR78A94RZwix2Akxhfc1tSafdw8tfRYZ2ufsyY_2wAZFnmirC3RtUE60DnGw7a4Y8hKHzCaIgobpqPUjKGg43L1gMFZbWBWMsiiumsHRZpxjl_fvA_hbd7VVnfUvQd%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D9df59487a22f18150b86f2ac0a2edaa5&TIME=20240426T131201Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:ADDDFB3E-F7AA-0DA8-A496-4D397794E5DF&deviceId=6896200621815266&muid=ADDDFB3EF7AA0DA8A4964D397794E5DF HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=1587A58F595C6BA93A47B10F58E76A70; _EDGE_S=SID=17953A12F55E692317572E92F43568B9
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=kGjnwdA1TI8EfoYfZC8mputeYrKln3fUDgJoFeNFgyU; domain=.bing.com; expires=Mon, 09-Jun-2025 20:12:15 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 1CCF385A91EF4B21B4686D09FEB21A50 Ref B: LON04EDGE0822 Ref C: 2024-05-15T20:12:15Z
    date: Wed, 15 May 2024 20:12:14 GMT
  • flag-us
    DNS
    79.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    79.190.18.2.in-addr.arpa
    IN PTR
    Response
    79.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-79deploystaticakamaitechnologiescom
  • flag-us
    DNS
    237.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    237.197.79.204.in-addr.arpa
    IN PTR
    Response
  • flag-be
    GET
    https://www.bing.com/aes/c.gif?RG=6925ea0d2b1b43b4b2c470e855aef754&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T131201Z&adUnitId=11730597&localId=w:ADDDFB3E-F7AA-0DA8-A496-4D397794E5DF&deviceId=6896200621815266
    Remote address:
    2.17.196.105:443
    Request
    GET /aes/c.gif?RG=6925ea0d2b1b43b4b2c470e855aef754&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T131201Z&adUnitId=11730597&localId=w:ADDDFB3E-F7AA-0DA8-A496-4D397794E5DF&deviceId=6896200621815266 HTTP/2.0
    host: www.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=1587A58F595C6BA93A47B10F58E76A70
    Response
    HTTP/2.0 200
    cache-control: private,no-store
    pragma: no-cache
    vary: Origin
    p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 637163FDAC8C47BBA2861C55AAFF945A Ref B: FRAEDGE1416 Ref C: 2024-05-15T20:12:15Z
    content-length: 0
    date: Wed, 15 May 2024 20:12:15 GMT
    set-cookie: _EDGE_S=SID=17953A12F55E692317572E92F43568B9; path=/; httponly; domain=bing.com
    set-cookie: MUIDB=1587A58F595C6BA93A47B10F58E76A70; path=/; httponly; expires=Mon, 09-Jun-2025 20:12:15 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.65c41102.1715803935.9315c87
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    71.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    71.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    105.196.17.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    105.196.17.2.in-addr.arpa
    IN PTR
    Response
    105.196.17.2.in-addr.arpa
    IN PTR
    a2-17-196-105deploystaticakamaitechnologiescom
  • flag-us
    DNS
    241.150.49.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.150.49.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    183.59.114.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.59.114.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    21.121.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    21.121.18.2.in-addr.arpa
    IN PTR
    Response
    21.121.18.2.in-addr.arpa
    IN PTR
    a2-18-121-21deploystaticakamaitechnologiescom
  • flag-us
    DNS
    249.197.17.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    249.197.17.2.in-addr.arpa
    IN PTR
    Response
    249.197.17.2.in-addr.arpa
    IN PTR
    a2-17-197-249deploystaticakamaitechnologiescom
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 430689
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 83ED8263AEFA4070B30859E5D857A0CE Ref B: LON04EDGE1116 Ref C: 2024-05-15T20:13:50Z
    date: Wed, 15 May 2024 20:13:50 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 415458
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 212B94280FD44AA7B41F2D8EE9D6311D Ref B: LON04EDGE1116 Ref C: 2024-05-15T20:13:50Z
    date: Wed, 15 May 2024 20:13:50 GMT
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • 204.79.197.237:443
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De89zHxmknVAgRMxVosanPnUzVUCUzGQRGaUmY9uhbv-4hVumDOqGAR78A94RZwix2Akxhfc1tSafdw8tfRYZ2ufsyY_2wAZFnmirC3RtUE60DnGw7a4Y8hKHzCaIgobpqPUjKGg43L1gMFZbWBWMsiiumsHRZpxjl_fvA_hbd7VVnfUvQd%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D9df59487a22f18150b86f2ac0a2edaa5&TIME=20240426T131201Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:ADDDFB3E-F7AA-0DA8-A496-4D397794E5DF&deviceId=6896200621815266&muid=ADDDFB3EF7AA0DA8A4964D397794E5DF
    tls, http2
    2.5kB
     9.0kB
     19
    17

    HTTP Request

    GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De89zHxmknVAgRMxVosanPnUzVUCUzGQRGaUmY9uhbv-4hVumDOqGAR78A94RZwix2Akxhfc1tSafdw8tfRYZ2ufsyY_2wAZFnmirC3RtUE60DnGw7a4Y8hKHzCaIgobpqPUjKGg43L1gMFZbWBWMsiiumsHRZpxjl_fvA_hbd7VVnfUvQd%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D9df59487a22f18150b86f2ac0a2edaa5&TIME=20240426T131201Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:ADDDFB3E-F7AA-0DA8-A496-4D397794E5DF&deviceId=6896200621815266&muid=ADDDFB3EF7AA0DA8A4964D397794E5DF

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De89zHxmknVAgRMxVosanPnUzVUCUzGQRGaUmY9uhbv-4hVumDOqGAR78A94RZwix2Akxhfc1tSafdw8tfRYZ2ufsyY_2wAZFnmirC3RtUE60DnGw7a4Y8hKHzCaIgobpqPUjKGg43L1gMFZbWBWMsiiumsHRZpxjl_fvA_hbd7VVnfUvQd%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D9df59487a22f18150b86f2ac0a2edaa5&TIME=20240426T131201Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:ADDDFB3E-F7AA-0DA8-A496-4D397794E5DF&deviceId=6896200621815266&muid=ADDDFB3EF7AA0DA8A4964D397794E5DF

    HTTP Response

    204
  • 2.17.196.105:443
    https://www.bing.com/aes/c.gif?RG=6925ea0d2b1b43b4b2c470e855aef754&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T131201Z&adUnitId=11730597&localId=w:ADDDFB3E-F7AA-0DA8-A496-4D397794E5DF&deviceId=6896200621815266
    tls, http2
    1.4kB
     5.3kB
     16
    11

    HTTP Request

    GET https://www.bing.com/aes/c.gif?RG=6925ea0d2b1b43b4b2c470e855aef754&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T131201Z&adUnitId=11730597&localId=w:ADDDFB3E-F7AA-0DA8-A496-4D397794E5DF&deviceId=6896200621815266

    HTTP Response

    200
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    tls, http2
    32.1kB
     883.2kB
     651
    648

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.1kB
     16
    14
  • 8.8.8.8:53
    first-usapro.info
    dns
    47d518309a5fc18bd56ddd1172c0b9f1_JaffaCakes118.exe
    63 B
     142 B
     1
    1

    DNS Request

    first-usapro.info

  • 8.8.8.8:53
    get-bluesee.info
    dns
    47d518309a5fc18bd56ddd1172c0b9f1_JaffaCakes118.exe
    62 B
     141 B
     1
    1

    DNS Request

    get-bluesee.info

  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    center-ring.info
    dns
    47d518309a5fc18bd56ddd1172c0b9f1_JaffaCakes118.exe
    62 B
     141 B
     1
    1

    DNS Request

    center-ring.info

  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     151 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    204.79.197.237
    13.107.21.237

  • 8.8.8.8:53
    79.190.18.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    79.190.18.2.in-addr.arpa

  • 8.8.8.8:53
    237.197.79.204.in-addr.arpa
    dns
    73 B
     143 B
     1
    1

    DNS Request

    237.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    71.31.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    71.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    105.196.17.2.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    105.196.17.2.in-addr.arpa

  • 8.8.8.8:53
    241.150.49.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    241.150.49.20.in-addr.arpa

  • 8.8.8.8:53
    183.59.114.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    183.59.114.20.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    21.121.18.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    21.121.18.2.in-addr.arpa

  • 8.8.8.8:53
    249.197.17.2.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    249.197.17.2.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     173 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
     106 B
     1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4252-0-0x0000000000F50000-0x0000000000F70000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4252-6-0x0000000000F50000-0x0000000000F70000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4252-1-0x0000000001720000-0x000000000174F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/4252-12-0x0000000000F50000-0x0000000000F70000-memory.dmp

    Filesize

    128KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.