d0dba0374419042523b88f1359e9cf44d368f0eb8fee33dcf8952554eae71b4d

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 01:15 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59de2adc7fc4d7ce74313b78f169bcb6_JaffaCakes118.exe
Size

138KB
MD5

59de2adc7fc4d7ce74313b78f169bcb6
SHA1

6a7c7db87f521855cbedad1bb22c33c04afbe52e
SHA256

d0dba0374419042523b88f1359e9cf44d368f0eb8fee33dcf8952554eae71b4d
SHA512

7398d104701ca5cee5de60655ab7642877548a36a5c450b5d3700a9bd31deb1e933f051c18bb855b523ac0be0c830269b4f1d3fddbcc84a21e9c08e1debe3dc1
SSDEEP

3072:ek4N3CZHIzANQrsrQwg/gngvQjA7AnJCag3JCZJCrwigRgHFTFggHgnQqQlQiwe8:ek4V4cora8zo0Ysru7gHT/A1ultJMsMP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	kiedu.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	59de2adc7fc4d7ce74313b78f169bcb6_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2860	kiedu.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiedu = "C:\\Users\\Admin\\kiedu.exe"	kiedu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe
2860	kiedu.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3936	59de2adc7fc4d7ce74313b78f169bcb6_JaffaCakes118.exe
2860	kiedu.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 2860	3936	59de2adc7fc4d7ce74313b78f169bcb6_JaffaCakes118.exe	87
PID 3936 wrote to memory of 2860	3936	59de2adc7fc4d7ce74313b78f169bcb6_JaffaCakes118.exe	87
PID 3936 wrote to memory of 2860	3936	59de2adc7fc4d7ce74313b78f169bcb6_JaffaCakes118.exe	87
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83
PID 2860 wrote to memory of 3936	2860	kiedu.exe	83

C:\Users\Admin\AppData\Local\Temp\59de2adc7fc4d7ce74313b78f169bcb6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\59de2adc7fc4d7ce74313b78f169bcb6_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Users\Admin\kiedu.exe
  "C:\Users\Admin\kiedu.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2860

Network

DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR
DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR
DNS

209.205.72.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

209.205.72.20.in-addr.arpa

IN PTR

Response
DNS

133.32.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

133.32.126.40.in-addr.arpa

IN PTR

Response
DNS

240.143.123.92.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.143.123.92.in-addr.arpa

IN PTR

Response

240.143.123.92.in-addr.arpa

IN PTR

a92-123-143-240deploystaticakamaitechnologiescom
DNS

ns2.theimageparlour.net

59de2adc7fc4d7ce74313b78f169bcb6_JaffaCakes118.exe

Remote address:

8.8.8.8:53

Request

ns2.theimageparlour.net

IN A

Response

ns2.theimageparlour.net

IN A

206.189.185.75
DNS

55.36.223.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

55.36.223.20.in-addr.arpa

IN PTR

Response
DNS

13.86.106.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

13.86.106.20.in-addr.arpa

IN PTR

Response
DNS

103.169.127.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

103.169.127.40.in-addr.arpa

IN PTR

Response
DNS

206.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.23.85.13.in-addr.arpa

IN PTR

Response
DNS

121.170.16.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

121.170.16.2.in-addr.arpa

IN PTR

Response

121.170.16.2.in-addr.arpa

IN PTR

a2-16-170-121deploystaticakamaitechnologiescom
DNS

172.214.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.214.232.199.in-addr.arpa

IN PTR

Response
DNS

43.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

43.229.111.52.in-addr.arpa

IN PTR

Response
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A

Response

tse1.mm.bing.net

IN CNAME

mm-mm.bing.net.trafficmanager.net

mm-mm.bing.net.trafficmanager.net

IN CNAME

ax-0001.ax-msedge.net

ax-0001.ax-msedge.net

IN A

150.171.27.10

ax-0001.ax-msedge.net

IN A

150.171.28.10
GET

https://tse1.mm.bing.net/th?id=OADD2.10239339388112_1D9RCOGNLARU8ARO7&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

150.171.27.10:443

Request

GET /th?id=OADD2.10239339388112_1D9RCOGNLARU8ARO7&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 248362
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 53F36F57B0D5432289C0026AB7394203 Ref B: LON04EDGE1220 Ref C: 2024-07-19T01:17:18Z
date: Fri, 19 Jul 2024 01:17:18 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239340418535_1J3FI1BHYFKNLDX7C&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

150.171.27.10:443

Request

GET /th?id=OADD2.10239340418535_1J3FI1BHYFKNLDX7C&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 383560
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 0A189363E70A4C24AAB2C621448509B5 Ref B: LON04EDGE1220 Ref C: 2024-07-19T01:17:18Z
date: Fri, 19 Jul 2024 01:17:18 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301195_10TKS815IX0MOD3NX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

150.171.27.10:443

Request

GET /th?id=OADD2.10239317301195_10TKS815IX0MOD3NX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 360094
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 3DB26D76E98B43F8B0B399B29A291BE5 Ref B: LON04EDGE1220 Ref C: 2024-07-19T01:17:18Z
date: Fri, 19 Jul 2024 01:17:18 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239340418536_1RXQC5FWNJZBHVB3M&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

150.171.27.10:443

Request

GET /th?id=OADD2.10239340418536_1RXQC5FWNJZBHVB3M&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 335594
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 552CEC28E1ED410D9949EA89A8E9E7F2 Ref B: LON04EDGE1220 Ref C: 2024-07-19T01:17:18Z
date: Fri, 19 Jul 2024 01:17:18 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239339388111_1XGVGDXXGM4UED7TP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

150.171.27.10:443

Request

GET /th?id=OADD2.10239339388111_1XGVGDXXGM4UED7TP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 439986
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F3A48BDEDF6A45EA9289A093F21B5BFE Ref B: LON04EDGE1220 Ref C: 2024-07-19T01:17:18Z
date: Fri, 19 Jul 2024 01:17:18 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301604_1H6WK0590WT095LZX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

150.171.27.10:443

Request

GET /th?id=OADD2.10239317301604_1H6WK0590WT095LZX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 317640
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F2CFBF99D2604D6B93508C215CCE6B87 Ref B: LON04EDGE1220 Ref C: 2024-07-19T01:17:19Z
date: Fri, 19 Jul 2024 01:17:18 GMT
DNS

10.27.171.150.in-addr.arpa

Remote address:

8.8.8.8:53

Request

10.27.171.150.in-addr.arpa

IN PTR

Response

150.171.27.10:443

https://tse1.mm.bing.net/th?id=OADD2.10239317301604_1H6WK0590WT095LZX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

tls, http2

76.0kB
2.2MB
1584
1581

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239339388112_1D9RCOGNLARU8ARO7&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239340418535_1J3FI1BHYFKNLDX7C&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301195_10TKS815IX0MOD3NX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239340418536_1RXQC5FWNJZBHVB3M&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239339388111_1XGVGDXXGM4UED7TP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301604_1H6WK0590WT095LZX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Response

200
150.171.27.10:443

tse1.mm.bing.net

tls, http2

1.2kB
6.9kB
15
13
150.171.27.10:443

tse1.mm.bing.net

tls, http2

1.2kB
6.9kB
15
13
150.171.27.10:443

tse1.mm.bing.net

tls, http2

1.2kB
6.9kB
15
13
150.171.27.10:443

tse1.mm.bing.net

tls, http2

1.2kB
6.9kB
15
13

8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

198 B
90 B
3
1

DNS Request

8.8.8.8.in-addr.arpa

DNS Request

8.8.8.8.in-addr.arpa

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

209.205.72.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

209.205.72.20.in-addr.arpa
8.8.8.8:53

133.32.126.40.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

133.32.126.40.in-addr.arpa
8.8.8.8:53

240.143.123.92.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

240.143.123.92.in-addr.arpa
8.8.8.8:53

ns2.theimageparlour.net

dns

59de2adc7fc4d7ce74313b78f169bcb6_JaffaCakes118.exe

69 B
85 B
1
1

DNS Request

ns2.theimageparlour.net

DNS Response

206.189.185.75
8.8.8.8:53

55.36.223.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

55.36.223.20.in-addr.arpa
8.8.8.8:53

13.86.106.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

13.86.106.20.in-addr.arpa
8.8.8.8:53

103.169.127.40.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

103.169.127.40.in-addr.arpa
8.8.8.8:53

206.23.85.13.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

206.23.85.13.in-addr.arpa
8.8.8.8:53

121.170.16.2.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

121.170.16.2.in-addr.arpa
8.8.8.8:53

172.214.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.214.232.199.in-addr.arpa
8.8.8.8:53

43.229.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

43.229.111.52.in-addr.arpa
8.8.8.8:53

tse1.mm.bing.net

dns

62 B
170 B
1
1

DNS Request

tse1.mm.bing.net

DNS Response

150.171.27.10

150.171.28.10
8.8.8.8:53

10.27.171.150.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

10.27.171.150.in-addr.arpa
8.8.8.8:53

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\kiedu.exe

Filesize
138KB

MD5
03b3fbbeb8d4b01b10bbd5e0df6e8587

SHA1
34b3e784fa3d306f7684c760f03818d740a068a8

SHA256
e5529d385afadcd1d1c29624b492091874e6eefafc24a5c8e3875a012456170c

SHA512
d76e13e26ea0841af98687ad4f45c4316d4e8950c78af04654722009b545eb7920213f8cafe4512a09a3043e55d4be94a4b93e663cd06ba0b896dca46905ecd1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.