Analysis
-
max time kernel
43s -
max time network
43s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2024 08:35
Static task
static1
Behavioral task
behavioral1
Sample
01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe
Resource
win10v2004-20240709-en
General
-
Target
01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe
-
Size
224KB
-
MD5
75031983cb851f3475c460a40797fe62
-
SHA1
4ee0238f082123aeb7642ea2e427f57cf4ee954a
-
SHA256
01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4
-
SHA512
635b72c7fb8d8b3818364a8a239941d4b4ec608f3d87ee966ce6abd599b847f2aee1e895d996391a1802a57afb41127fbc5e87020b5b280aca2066039e94ca36
-
SSDEEP
3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/Efc:+5RwTs/dSXj84mRXPemxdBlPvLzLe
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt
wannacry
15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDB595.tmp 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDB5BC.tmp 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe -
Executes dropped EXE 4 IoCs
pid Process 3116 !WannaDecryptor!.exe 2112 !WannaDecryptor!.exe 1524 !WannaDecryptor!.exe 2252 !WannaDecryptor!.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe\" /r" 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp" !WannaDecryptor!.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language !WannaDecryptor!.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language !WannaDecryptor!.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language !WannaDecryptor!.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language !WannaDecryptor!.exe -
Kills process with taskkill 4 IoCs
pid Process 2888 taskkill.exe 2108 taskkill.exe 3096 taskkill.exe 1404 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 1404 taskkill.exe Token: SeDebugPrivilege 2108 taskkill.exe Token: SeDebugPrivilege 2888 taskkill.exe Token: SeDebugPrivilege 3096 taskkill.exe Token: SeIncreaseQuotaPrivilege 1876 WMIC.exe Token: SeSecurityPrivilege 1876 WMIC.exe Token: SeTakeOwnershipPrivilege 1876 WMIC.exe Token: SeLoadDriverPrivilege 1876 WMIC.exe Token: SeSystemProfilePrivilege 1876 WMIC.exe Token: SeSystemtimePrivilege 1876 WMIC.exe Token: SeProfSingleProcessPrivilege 1876 WMIC.exe Token: SeIncBasePriorityPrivilege 1876 WMIC.exe Token: SeCreatePagefilePrivilege 1876 WMIC.exe Token: SeBackupPrivilege 1876 WMIC.exe Token: SeRestorePrivilege 1876 WMIC.exe Token: SeShutdownPrivilege 1876 WMIC.exe Token: SeDebugPrivilege 1876 WMIC.exe Token: SeSystemEnvironmentPrivilege 1876 WMIC.exe Token: SeRemoteShutdownPrivilege 1876 WMIC.exe Token: SeUndockPrivilege 1876 WMIC.exe Token: SeManageVolumePrivilege 1876 WMIC.exe Token: 33 1876 WMIC.exe Token: 34 1876 WMIC.exe Token: 35 1876 WMIC.exe Token: 36 1876 WMIC.exe Token: SeIncreaseQuotaPrivilege 1876 WMIC.exe Token: SeSecurityPrivilege 1876 WMIC.exe Token: SeTakeOwnershipPrivilege 1876 WMIC.exe Token: SeLoadDriverPrivilege 1876 WMIC.exe Token: SeSystemProfilePrivilege 1876 WMIC.exe Token: SeSystemtimePrivilege 1876 WMIC.exe Token: SeProfSingleProcessPrivilege 1876 WMIC.exe Token: SeIncBasePriorityPrivilege 1876 WMIC.exe Token: SeCreatePagefilePrivilege 1876 WMIC.exe Token: SeBackupPrivilege 1876 WMIC.exe Token: SeRestorePrivilege 1876 WMIC.exe Token: SeShutdownPrivilege 1876 WMIC.exe Token: SeDebugPrivilege 1876 WMIC.exe Token: SeSystemEnvironmentPrivilege 1876 WMIC.exe Token: SeRemoteShutdownPrivilege 1876 WMIC.exe Token: SeUndockPrivilege 1876 WMIC.exe Token: SeManageVolumePrivilege 1876 WMIC.exe Token: 33 1876 WMIC.exe Token: 34 1876 WMIC.exe Token: 35 1876 WMIC.exe Token: 36 1876 WMIC.exe Token: SeBackupPrivilege 1956 vssvc.exe Token: SeRestorePrivilege 1956 vssvc.exe Token: SeAuditPrivilege 1956 vssvc.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3116 !WannaDecryptor!.exe 3116 !WannaDecryptor!.exe 2112 !WannaDecryptor!.exe 2112 !WannaDecryptor!.exe 1524 !WannaDecryptor!.exe 1524 !WannaDecryptor!.exe 2252 !WannaDecryptor!.exe 2252 !WannaDecryptor!.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2884 wrote to memory of 1456 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 84 PID 2884 wrote to memory of 1456 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 84 PID 2884 wrote to memory of 1456 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 84 PID 1456 wrote to memory of 4184 1456 cmd.exe 86 PID 1456 wrote to memory of 4184 1456 cmd.exe 86 PID 1456 wrote to memory of 4184 1456 cmd.exe 86 PID 2884 wrote to memory of 3116 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 90 PID 2884 wrote to memory of 3116 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 90 PID 2884 wrote to memory of 3116 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 90 PID 2884 wrote to memory of 1404 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 91 PID 2884 wrote to memory of 1404 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 91 PID 2884 wrote to memory of 1404 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 91 PID 2884 wrote to memory of 3096 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 92 PID 2884 wrote to memory of 3096 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 92 PID 2884 wrote to memory of 3096 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 92 PID 2884 wrote to memory of 2108 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 93 PID 2884 wrote to memory of 2108 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 93 PID 2884 wrote to memory of 2108 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 93 PID 2884 wrote to memory of 2888 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 94 PID 2884 wrote to memory of 2888 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 94 PID 2884 wrote to memory of 2888 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 94 PID 2884 wrote to memory of 2112 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 107 PID 2884 wrote to memory of 2112 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 107 PID 2884 wrote to memory of 2112 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 107 PID 2884 wrote to memory of 3532 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 108 PID 2884 wrote to memory of 3532 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 108 PID 2884 wrote to memory of 3532 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 108 PID 3532 wrote to memory of 1524 3532 cmd.exe 110 PID 3532 wrote to memory of 1524 3532 cmd.exe 110 PID 3532 wrote to memory of 1524 3532 cmd.exe 110 PID 2884 wrote to memory of 2252 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 112 PID 2884 wrote to memory of 2252 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 112 PID 2884 wrote to memory of 2252 2884 01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe 112 PID 1524 wrote to memory of 1124 1524 !WannaDecryptor!.exe 113 PID 1524 wrote to memory of 1124 1524 !WannaDecryptor!.exe 113 PID 1524 wrote to memory of 1124 1524 !WannaDecryptor!.exe 113 PID 1124 wrote to memory of 1876 1124 cmd.exe 115 PID 1124 wrote to memory of 1876 1124 cmd.exe 115 PID 1124 wrote to memory of 1876 1124 cmd.exe 115 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe"C:\Users\Admin\AppData\Local\Temp\01ce2c3c8448bae948c37ceeb6e9631805055738b5b94b22dfa8a005ece895c4.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 307071721896589.bat2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\SysWOW64\cscript.execscript //nologo c.vbs3⤵
- System Location Discovery: System Language Discovery
PID:4184
-
-
-
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe!WannaDecryptor!.exe f2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3116
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im MSExchange*2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1404
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Microsoft.Exchange.*2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3096
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlserver.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2108
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlwriter.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
-
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe!WannaDecryptor!.exe c2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2112
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b !WannaDecryptor!.exe v2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe!WannaDecryptor!.exe v3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe!WannaDecryptor!.exe2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2252
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1956
Network
-
Remote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.dual-a-0034.a-msedge.netg-bing-com.dual-a-0034.a-msedge.netIN CNAMEdual-a-0034.a-msedge.netdual-a-0034.a-msedge.netIN A204.79.197.237dual-a-0034.a-msedge.netIN A13.107.21.237
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=09e1d338b2a24761b0c488e95b9899e8&localId=w:5B67E6EF-EB19-3B8C-6273-F1B27270E62E&deviceId=6896204247044651&anid=Remote address:204.79.197.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=09e1d338b2a24761b0c488e95b9899e8&localId=w:5B67E6EF-EB19-3B8C-6273-F1B27270E62E&deviceId=6896204247044651&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=30AB6FFF6E3E678302277B386FDE66D9; domain=.bing.com; expires=Tue, 19-Aug-2025 08:36:31 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 96E8353FFF2745C7BC6D45930FAECA04 Ref B: LON04EDGE1205 Ref C: 2024-07-25T08:36:31Z
date: Thu, 25 Jul 2024 08:36:31 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=09e1d338b2a24761b0c488e95b9899e8&localId=w:5B67E6EF-EB19-3B8C-6273-F1B27270E62E&deviceId=6896204247044651&anid=Remote address:204.79.197.237:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=09e1d338b2a24761b0c488e95b9899e8&localId=w:5B67E6EF-EB19-3B8C-6273-F1B27270E62E&deviceId=6896204247044651&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=30AB6FFF6E3E678302277B386FDE66D9
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=y03lMmHtEDvVM4M71fXd28B6RxA--kv9fEpF_NpC-NE; domain=.bing.com; expires=Tue, 19-Aug-2025 08:36:31 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 58BD5CB202434E078B0B6D1C7788C9E7 Ref B: LON04EDGE1205 Ref C: 2024-07-25T08:36:31Z
date: Thu, 25 Jul 2024 08:36:31 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=09e1d338b2a24761b0c488e95b9899e8&localId=w:5B67E6EF-EB19-3B8C-6273-F1B27270E62E&deviceId=6896204247044651&anid=Remote address:204.79.197.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=09e1d338b2a24761b0c488e95b9899e8&localId=w:5B67E6EF-EB19-3B8C-6273-F1B27270E62E&deviceId=6896204247044651&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=30AB6FFF6E3E678302277B386FDE66D9; MSPTC=y03lMmHtEDvVM4M71fXd28B6RxA--kv9fEpF_NpC-NE
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: A422FDC79C694328A6BEF334471A0D2C Ref B: LON04EDGE1205 Ref C: 2024-07-25T08:36:31Z
date: Thu, 25 Jul 2024 08:36:31 GMT
-
Remote address:8.8.8.8:53Request140.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request237.197.79.204.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
204.79.197.237:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=09e1d338b2a24761b0c488e95b9899e8&localId=w:5B67E6EF-EB19-3B8C-6273-F1B27270E62E&deviceId=6896204247044651&anid=tls, http22.0kB 9.3kB 21 18
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=09e1d338b2a24761b0c488e95b9899e8&localId=w:5B67E6EF-EB19-3B8C-6273-F1B27270E62E&deviceId=6896204247044651&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=09e1d338b2a24761b0c488e95b9899e8&localId=w:5B67E6EF-EB19-3B8C-6273-F1B27270E62E&deviceId=6896204247044651&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=09e1d338b2a24761b0c488e95b9899e8&localId=w:5B67E6EF-EB19-3B8C-6273-F1B27270E62E&deviceId=6896204247044651&anid=HTTP Response
204 -
-
-
-
-
-
-
-
-
-
-
-
-
-
-
73 B 147 B 1 1
DNS Request
196.249.167.52.in-addr.arpa
-
56 B 151 B 1 1
DNS Request
g.bing.com
DNS Response
204.79.197.23713.107.21.237
-
72 B 158 B 1 1
DNS Request
140.32.126.40.in-addr.arpa
-
73 B 143 B 1 1
DNS Request
237.197.79.204.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
58.55.71.13.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
50.23.12.20.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
206.23.85.13.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
797B
MD5afa18cf4aa2660392111763fb93a8c3d
SHA1c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA256227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
SHA5124161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b
-
Filesize
1KB
MD50db5c42606387ccc928b1887197a3886
SHA109a4be81f24f215027eb84bf3cb952f2bb9439b5
SHA256b2dd2e3ddce03e533e42c9f33eb32de8629c611cc68c9146e1b88a034dc7c868
SHA5122e9a278c020339a4064638800936a7a546cdce02c2d76bbbdddc84440030ae23dbdc2f2ce00511ccae553b98f47a086ca1ce5b0d5355b4bac1fd31bff822b4af
-
Filesize
136B
MD51b25ceed533d1378ab842f85ff5dedbf
SHA1a7287d406ee0243f510003445e6b582fd7542f84
SHA256ad8c20db3fb8fb58e7fff55763a5834c9ce1df2318b2bc8ce1bfc87d0f12bb89
SHA51299aa5b0c720347e6a16052ee259ae1a6e601ec7f7bf94ae30a66b2329243ad04f06313f2b47ad4d373223799178edf6c342f266ea574136f9e328a70e7439295
-
Filesize
136B
MD59c3371f133928f9082cea7a749c2fd58
SHA13752a15428e6510bab3a4af7f434ff10f4524a24
SHA256af998f53963485bcf4d4731e0cbc125f3b3f15e08145d2a55a00df424a320a80
SHA51282f43c6bcdb492bce5260907db9de05d8f2bf1196e9e1f3dabae634582cfc430b5a81155c4d16a5d609ab3abb9d343e1fa371be62fe3ebdf4b324550db42a1e4
-
Filesize
136B
MD52629cd5dc2de39be582e5786c1f5bb8a
SHA124cbf0b9505c774c6aa3a72f276beb5b4e0fafe9
SHA256062bd826491fcc3ac63672dc756380f8f7a8ef91aea0a27327696f509f4429f0
SHA512ea045f2387a122bb244f933201366cb9c4c7ff58206fc71270e4902c3fda91ec47434509db67cee465883fef43e2fee7bdb2880eb42ddc41e9b7503e700db4cd
-
Filesize
336B
MD53540e056349c6972905dc9706cd49418
SHA1492c20442d34d45a6d6790c720349b11ec591cde
SHA25673872a89440a2cba9d22bf4961c3d499ea2c72979c30c455f942374292fedadc
SHA512c949d147100aef59e382c03abf7b162ae62a4d43456eebd730fbedcf5f95f5e1a24f6e349690d52d75331878a6ee8f6b88a7162ee9cf2a49e142196b12d0133c
-
Filesize
219B
MD55f6d40ca3c34b470113ed04d06a88ff4
SHA150629e7211ae43e32060686d6be17ebd492fd7aa
SHA2560fb5039a2fe7e90cdf3f22140d7f2103f94689b15609efe0edcc8430dd772fc1
SHA5124d4aa1abd2c9183202fd3f0a65b37f07ee0166ba6561f094c13c8ea59752c7bdd960e37c49583746d4464bc3b1dc0b63a1fe36a37ce7e5709cd76ed433befe35
-
Filesize
628B
MD5ab1a616e564e368486f18b99f38897d6
SHA1764f1e313df59cb4dd088aeb4732be868a189f18
SHA2568f980383dfdd33235f26d1faef5798dd18ab4bc2f7989f2896b1f88f2f6945f2
SHA512e23cf97e0c8fbf3637c5843dd9b8c61b0a4d21b598b84b691b4af0fc64d28444152dc68f24f706b025224766509f66b8d8eb98109c43a0bf55077e82546b64f7
-
Filesize
42KB
MD5980b08bac152aff3f9b0136b616affa5
SHA12a9c9601ea038f790cc29379c79407356a3d25a3
SHA256402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
SHA512100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496
-
Filesize
236KB
MD5cf1416074cd7791ab80a18f9e7e219d9
SHA1276d2ec82c518d887a8a3608e51c56fa28716ded
SHA25678e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
SHA5120bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5