Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

633ea3f02e...18.exe

windows7-x64

10

633ea3f02e...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 12:50 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    633ea3f02e5af0b944e262579a0bd104_JaffaCakes118.exe

  • Size

    960KB

  • MD5

    633ea3f02e5af0b944e262579a0bd104

  • SHA1

    f026dab6d57a0c91fc50426ad6eb302df3ade9cf

  • SHA256

    2c4ec961cbfbd97190b73e8825c3326f343f0efcfea615fb88f7de48ff693b7f

  • SHA512

    e81bbf4cf79a4d01dcb98d43e9c3ca20b118eda23d5b2567017df1f95302c92cef12ff133ef580418a9196a881321fa1cca68990b0da19521f0e2647b8793a04

  • SSDEEP

    24576:QnHwA5D5D+iR6zhgqEgPjpdsUowULHGiYKm8:KV7LkCUoNHc8

Score
10/10
darkcometbootkitpersistencerattrojan

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\633ea3f02e5af0b944e262579a0bd104_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\633ea3f02e5af0b944e262579a0bd104_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1480
    • C:\Users\Admin\AppData\Local\Temp\633ea3f02e5af0b944e262579a0bd104_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\633ea3f02e5af0b944e262579a0bd104_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3188
      • C:\Users\Admin\AppData\Local\Temp\eNdw3.exe
        "C:\Users\Admin\AppData\Local\Temp\eNdw3.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4620
        • C:\Users\Admin\AppData\Local\Temp\eNdw3.exe
          "C:\Users\Admin\AppData\Local\Temp\eNdw3.exe"
          4⤵
          • Executes dropped EXE
          • Writes to the Master Boot Record (MBR)
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4444
          • C:\Users\Admin\AppData\Local\Temp\eNdw3.exe
            "C:\Users\Admin\AppData\Local\Temp\eNdw3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:444

Network

  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    241.150.49.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.150.49.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    157.123.68.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    157.123.68.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    192.142.123.92.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    192.142.123.92.in-addr.arpa
    IN PTR
    Response
    192.142.123.92.in-addr.arpa
    IN PTR
    a92-123-142-192deploystaticakamaitechnologiescom
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
  • flag-us
    DNS
    48.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    48.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    26.35.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.35.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    45.19.74.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    45.19.74.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    45.19.74.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    45.19.74.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301444_1ADW5UG9KMTHYULQ8&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239317301444_1ADW5UG9KMTHYULQ8&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 352599
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 12CBD01B3FDA47B8B4538A167FAF8274 Ref B: LON04EDGE0608 Ref C: 2024-07-22T12:52:58Z
    date: Mon, 22 Jul 2024 12:52:58 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301601_1XLI7BR2VR1H1YJXB&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239317301601_1XLI7BR2VR1H1YJXB&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 357673
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: F41FDD6A964F42C1B03233276E2B3755 Ref B: LON04EDGE0608 Ref C: 2024-07-22T12:52:58Z
    date: Mon, 22 Jul 2024 12:52:58 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301192_1O6NEWTZHCNXAKIDN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239317301192_1O6NEWTZHCNXAKIDN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 331612
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 11DE155C83DB4B378E1BFC4AB6C63F27 Ref B: LON04EDGE0608 Ref C: 2024-07-22T12:52:58Z
    date: Mon, 22 Jul 2024 12:52:58 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301011_1Q64Y8U9UJ0Y7FTOQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239317301011_1Q64Y8U9UJ0Y7FTOQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 343343
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 42DC5250A17C4EE68C14F4119EE5DC74 Ref B: LON04EDGE0608 Ref C: 2024-07-22T12:52:58Z
    date: Mon, 22 Jul 2024 12:52:58 GMT
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • flag-us
    DNS
    10.27.171.150.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    10.27.171.150.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    10.27.171.150.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    10.27.171.150.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    zap789.no-ip.org
    eNdw3.exe
    Remote address:
    8.8.8.8:53
    Request
    zap789.no-ip.org
    IN A
    Response
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 150.171.27.10:443
    https://tse1.mm.bing.net/th?id=OADD2.10239317301011_1Q64Y8U9UJ0Y7FTOQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    tls, http2
    52.4kB
     1.4MB
     1069
    1066

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301444_1ADW5UG9KMTHYULQ8&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301601_1XLI7BR2VR1H1YJXB&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301192_1O6NEWTZHCNXAKIDN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301011_1Q64Y8U9UJ0Y7FTOQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    88.156.103.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    88.156.103.20.in-addr.arpa

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    241.150.49.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    241.150.49.20.in-addr.arpa

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    157.123.68.40.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    157.123.68.40.in-addr.arpa

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    192.142.123.92.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    192.142.123.92.in-addr.arpa

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    124 B
     122 B
     2
    1

    DNS Request

    zap789.no-ip.org

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    48.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    48.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    26.35.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    26.35.223.20.in-addr.arpa

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    124 B
     244 B
     2
    2

    DNS Request

    zap789.no-ip.org

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    45.19.74.20.in-addr.arpa
    dns
    140 B
     312 B
     2
    2

    DNS Request

    45.19.74.20.in-addr.arpa

    DNS Request

    45.19.74.20.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    124 B
     340 B
     2
    2

    DNS Request

    tse1.mm.bing.net

    DNS Request

    tse1.mm.bing.net

    DNS Response

    150.171.27.10
    150.171.28.10

    DNS Response

    150.171.27.10
    150.171.28.10

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    124 B
     244 B
     2
    2

    DNS Request

    zap789.no-ip.org

    DNS Request

    zap789.no-ip.org

  • 8.8.8.8:53
    10.27.171.150.in-addr.arpa
    dns
    144 B
     316 B
     2
    2

    DNS Request

    10.27.171.150.in-addr.arpa

    DNS Request

    10.27.171.150.in-addr.arpa

  • 8.8.8.8:53
    zap789.no-ip.org
    dns
    eNdw3.exe
    62 B
     122 B
     1
    1

    DNS Request

    zap789.no-ip.org

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\eNdw3.exe
    Filesize

    800KB

    MD5

    bb8b36678d1c3c353815b399ee3421cf

    SHA1

    cb69c3f98fb30b9a16dd39d73f35c62da617ea23

    SHA256

    ed699c425584c12306c5673e96f769698504cf05d733696bdcee2964a4ad9b57

    SHA512

    3e595c116f341046ebb03520b159fcba7c0f8a5f72f3e341a35ea1380b86c6ae5ca0f41fa9741ef70f87b68b99e5c2468206fa12f675aec5b828ce6a8d2409dd

    Download Submit

  • memory/444-52-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

    Download

  • memory/444-50-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

    Download

  • memory/444-66-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

    Download

  • memory/444-64-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

    Download

  • memory/444-27-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

    Download

  • memory/444-29-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

    Download

  • memory/444-62-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

    Download

  • memory/444-33-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

    Download

  • memory/444-34-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

    Download

  • memory/444-36-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

    Download

  • memory/444-37-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

    Download

  • memory/444-35-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

    Download

  • memory/444-60-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

    Download

  • memory/444-39-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

    Download

  • memory/444-58-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

    Download

  • memory/444-43-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

    Download

  • memory/444-41-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

    Download

  • memory/444-46-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

    Download

  • memory/444-48-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

    Download

  • memory/444-44-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

    Download

  • memory/444-56-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

    Download

  • memory/444-54-0x0000000000400000-0x00000000004B3000-memory.dmp

    Filesize

    716KB

    Download

  • memory/3188-2-0x0000000000400000-0x00000000004D6000-memory.dmp

    Filesize

    856KB

    Download

  • memory/3188-4-0x0000000000400000-0x00000000004D6000-memory.dmp

    Filesize

    856KB

    Download

  • memory/3188-38-0x0000000000400000-0x00000000004D6000-memory.dmp

    Filesize

    856KB

    Download

  • memory/3188-63-0x0000000000400000-0x00000000004D6000-memory.dmp

    Filesize

    856KB

    Download

  • memory/4444-32-0x0000000000400000-0x00000000004AE000-memory.dmp

    Filesize

    696KB

    Download

  • memory/4444-24-0x0000000000400000-0x00000000004AE000-memory.dmp

    Filesize

    696KB

    Download

  • memory/4444-21-0x0000000000400000-0x00000000004AE000-memory.dmp

    Filesize

    696KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.