Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

615980974c...18.exe

windows7-x64

10

615980974c...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/10/2024, 08:48 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    615980974c3cd0617493683e879293a4_JaffaCakes118.exe

  • Size

    75KB

  • MD5

    615980974c3cd0617493683e879293a4

  • SHA1

    5059f260284f55c869b7ec4d2b6cc1875f66b422

  • SHA256

    fcbf515ddd19f888f892cddbebfab9d9c666d2eb4afde374fee8d1128cf89d3a

  • SHA512

    bb5ef9a1e8710a3b38f3b6d908cb46f10aa7831108bd1c169da3de427d440907d924635e47ec2eb8eb663e1ad4246d952fa2d77aecedc2abd2ae863e58daf31c

  • SSDEEP

    768:kE9hghdN12Ozhiow2Gkm6+c3/6tzo0qZOp69AwR:ku+zMOlw2GkmS3ytoW+z

Score
10/10
xtremeratdiscoverypersistenceratspywareupx

Malware Config

Signatures

  • Detect XtremeRAT payload 6 IoCs
  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\615980974c3cd0617493683e879293a4_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\615980974c3cd0617493683e879293a4_JaffaCakes118.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1508
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:3048
    • C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      2⤵
        PID:4784
      • C:\Windows\SysWOW64\explorer.exe
        explorer.exe
        2⤵
          PID:2888
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4108

      Network

      • flag-us
        DNS
        8.8.8.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        8.8.8.8.in-addr.arpa
        IN PTR
        Response
        8.8.8.8.in-addr.arpa
        IN PTR
        dnsgoogle
      • flag-us
        DNS
        g.bing.com
        Remote address:
        8.8.8.8:53
        Request
        g.bing.com
        IN A
        Response
        g.bing.com
        IN CNAME
        g-bing-com.ax-0001.ax-msedge.net
        g-bing-com.ax-0001.ax-msedge.net
        IN CNAME
        ax-0001.ax-msedge.net
        ax-0001.ax-msedge.net
        IN A
        150.171.28.10
        ax-0001.ax-msedge.net
        IN A
        150.171.27.10
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=5d3a9295f56c4fc1a3c240fa647b55fd&localId=w:740B9CEB-14AC-B2F7-6798-137B0EC388FF&deviceId=6825841072483399&anid=
        Remote address:
        150.171.28.10:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=5d3a9295f56c4fc1a3c240fa647b55fd&localId=w:740B9CEB-14AC-B2F7-6798-137B0EC388FF&deviceId=6825841072483399&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MUID=0A745CA165766B143DE249BF64E96A62; domain=.bing.com; expires=Fri, 14-Nov-2025 08:48:15 GMT; path=/; SameSite=None; Secure; Priority=High;
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 03931F20717A499D857BF7FA35EF3E86 Ref B: LON601060104029 Ref C: 2024-10-20T08:48:15Z
        date: Sun, 20 Oct 2024 08:48:14 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=5d3a9295f56c4fc1a3c240fa647b55fd&localId=w:740B9CEB-14AC-B2F7-6798-137B0EC388FF&deviceId=6825841072483399&anid=
        Remote address:
        150.171.28.10:443
        Request
        GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=5d3a9295f56c4fc1a3c240fa647b55fd&localId=w:740B9CEB-14AC-B2F7-6798-137B0EC388FF&deviceId=6825841072483399&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=0A745CA165766B143DE249BF64E96A62
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MSPTC=MfRoTzaWaY9byuUNE4ilXFBMEw7SK2f3ohgb2J29IIo; domain=.bing.com; expires=Fri, 14-Nov-2025 08:48:15 GMT; path=/; Partitioned; secure; SameSite=None
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: B9C0F279BEFF4AAF9C20F27B37615F7E Ref B: LON601060104029 Ref C: 2024-10-20T08:48:15Z
        date: Sun, 20 Oct 2024 08:48:14 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=5d3a9295f56c4fc1a3c240fa647b55fd&localId=w:740B9CEB-14AC-B2F7-6798-137B0EC388FF&deviceId=6825841072483399&anid=
        Remote address:
        150.171.28.10:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=5d3a9295f56c4fc1a3c240fa647b55fd&localId=w:740B9CEB-14AC-B2F7-6798-137B0EC388FF&deviceId=6825841072483399&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=0A745CA165766B143DE249BF64E96A62; MSPTC=MfRoTzaWaY9byuUNE4ilXFBMEw7SK2f3ohgb2J29IIo
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 2994A9AEBAE1440CB8538FB820F27A2C Ref B: LON601060104029 Ref C: 2024-10-20T08:48:15Z
        date: Sun, 20 Oct 2024 08:48:14 GMT
      • flag-us
        DNS
        97.17.167.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        97.17.167.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        98.209.201.84.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        98.209.201.84.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        17.160.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        17.160.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        104.219.191.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        104.219.191.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        154.239.44.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        154.239.44.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
      • flag-us
        DNS
        197.87.175.4.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        197.87.175.4.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        18.31.95.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.31.95.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        172.210.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.210.232.199.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        105.209.201.84.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        105.209.201.84.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
      • flag-us
        DNS
        21.236.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        21.236.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        tse1.mm.bing.net
        Remote address:
        8.8.8.8:53
        Request
        tse1.mm.bing.net
        IN A
        Response
        tse1.mm.bing.net
        IN CNAME
        mm-mm.bing.net.trafficmanager.net
        mm-mm.bing.net.trafficmanager.net
        IN CNAME
        ax-0001.ax-msedge.net
        ax-0001.ax-msedge.net
        IN A
        150.171.28.10
        ax-0001.ax-msedge.net
        IN A
        150.171.27.10
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239339388229_1X5TLMI7W26L9HRSX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239339388229_1X5TLMI7W26L9HRSX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 214672
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 215E5A8F1135405B89A42685541112FB Ref B: LON601060103062 Ref C: 2024-10-20T08:49:53Z
        date: Sun, 20 Oct 2024 08:49:52 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239339388228_1PR537X02WDD7KMIN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239339388228_1PR537X02WDD7KMIN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 761345
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: E0FFF22CD2B44EEC9FE0A72498E6857D Ref B: LON601060103062 Ref C: 2024-10-20T08:49:53Z
        date: Sun, 20 Oct 2024 08:49:52 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239340418574_15LZ4V0VK97RULTEQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239340418574_15LZ4V0VK97RULTEQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 227832
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 2D558C3B5F7F46A2AFBDB0DB04980051 Ref B: LON601060103062 Ref C: 2024-10-20T08:49:53Z
        date: Sun, 20 Oct 2024 08:49:52 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239398629830_1RPYGH00DJD1WMKQO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239398629830_1RPYGH00DJD1WMKQO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 688331
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: A8B7BD7BE7DD45909F51E724C1191F2D Ref B: LON601060103062 Ref C: 2024-10-20T08:49:53Z
        date: Sun, 20 Oct 2024 08:49:52 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239340418573_1OCPZP6XQOXA94H84&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239340418573_1OCPZP6XQOXA94H84&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 442929
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 06FAF012C7514A408DEEE79FADA3750B Ref B: LON601060103062 Ref C: 2024-10-20T08:49:53Z
        date: Sun, 20 Oct 2024 08:49:52 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239398629842_1ZAQRRM6HYDFONDBE&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239398629842_1ZAQRRM6HYDFONDBE&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 668226
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: F8EDF5348C0F43429365FC9A241D567E Ref B: LON601060103062 Ref C: 2024-10-20T08:49:53Z
        date: Sun, 20 Oct 2024 08:49:52 GMT
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        26.35.223.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        26.35.223.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        26.35.223.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        26.35.223.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • flag-us
        DNS
        mr-bean.no-ip.org
        explorer.exe
        Remote address:
        8.8.8.8:53
        Request
        mr-bean.no-ip.org
        IN A
        Response
      • 150.171.28.10:443
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=5d3a9295f56c4fc1a3c240fa647b55fd&localId=w:740B9CEB-14AC-B2F7-6798-137B0EC388FF&deviceId=6825841072483399&anid=
        tls, http2
        2.0kB
         9.4kB
         22
        19

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=5d3a9295f56c4fc1a3c240fa647b55fd&localId=w:740B9CEB-14AC-B2F7-6798-137B0EC388FF&deviceId=6825841072483399&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=5d3a9295f56c4fc1a3c240fa647b55fd&localId=w:740B9CEB-14AC-B2F7-6798-137B0EC388FF&deviceId=6825841072483399&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=5d3a9295f56c4fc1a3c240fa647b55fd&localId=w:740B9CEB-14AC-B2F7-6798-137B0EC388FF&deviceId=6825841072483399&anid=

        HTTP Response

        204
      • 150.171.28.10:443
        https://tse1.mm.bing.net/th?id=OADD2.10239398629842_1ZAQRRM6HYDFONDBE&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        tls, http2
        122.2kB
         3.2MB
         2314
        2307

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239339388229_1X5TLMI7W26L9HRSX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239339388228_1PR537X02WDD7KMIN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239340418574_15LZ4V0VK97RULTEQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239398629830_1RPYGH00DJD1WMKQO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239340418573_1OCPZP6XQOXA94H84&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239398629842_1ZAQRRM6HYDFONDBE&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Response

        200
      • 150.171.28.10:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         6.9kB
         15
        13
      • 150.171.28.10:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         6.9kB
         15
        13
      • 150.171.28.10:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         6.9kB
         15
        13
      • 150.171.28.10:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         6.9kB
         15
        13
      • 8.8.8.8:53
        8.8.8.8.in-addr.arpa
        dns
        66 B
         90 B
         1
        1

        DNS Request

        8.8.8.8.in-addr.arpa

      • 8.8.8.8:53
        g.bing.com
        dns
        56 B
         148 B
         1
        1

        DNS Request

        g.bing.com

        DNS Response

        150.171.28.10
        150.171.27.10

      • 8.8.8.8:53
        97.17.167.52.in-addr.arpa
        dns
        71 B
         145 B
         1
        1

        DNS Request

        97.17.167.52.in-addr.arpa

      • 8.8.8.8:53
        98.209.201.84.in-addr.arpa
        dns
        72 B
         132 B
         1
        1

        DNS Request

        98.209.201.84.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        17.160.190.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        17.160.190.20.in-addr.arpa

      • 8.8.8.8:53
        104.219.191.52.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        104.219.191.52.in-addr.arpa

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        63 B
         123 B
         1
        1

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        126 B
         123 B
         2
        1

        DNS Request

        mr-bean.no-ip.org

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        63 B
         123 B
         1
        1

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        154.239.44.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        154.239.44.20.in-addr.arpa

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        63 B
         123 B
         1
        1

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        63 B
         123 B
         1
        1

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        189 B
         123 B
         3
        1

        DNS Request

        mr-bean.no-ip.org

        DNS Request

        mr-bean.no-ip.org

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        197.87.175.4.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        197.87.175.4.in-addr.arpa

      • 8.8.8.8:53
        18.31.95.13.in-addr.arpa
        dns
        70 B
         144 B
         1
        1

        DNS Request

        18.31.95.13.in-addr.arpa

      • 8.8.8.8:53
        172.210.232.199.in-addr.arpa
        dns
        74 B
         128 B
         1
        1

        DNS Request

        172.210.232.199.in-addr.arpa

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        63 B
         123 B
         1
        1

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        63 B
         123 B
         1
        1

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        63 B
         123 B
         1
        1

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        63 B
         123 B
         1
        1

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        63 B
         123 B
         1
        1

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        63 B
         123 B
         1
        1

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        105.209.201.84.in-addr.arpa
        dns
        73 B
         133 B
         1
        1

        DNS Request

        105.209.201.84.in-addr.arpa

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        63 B
         123 B
         1
        1

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        63 B
         123 B
         1
        1

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        63 B
         123 B
         1
        1

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        63 B
         123 B
         1
        1

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        63 B
         123 B
         1
        1

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        126 B
         123 B
         2
        1

        DNS Request

        mr-bean.no-ip.org

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        21.236.111.52.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        21.236.111.52.in-addr.arpa

      • 8.8.8.8:53
        tse1.mm.bing.net
        dns
        62 B
         170 B
         1
        1

        DNS Request

        tse1.mm.bing.net

        DNS Response

        150.171.28.10
        150.171.27.10

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        63 B
         123 B
         1
        1

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        26.35.223.20.in-addr.arpa
        dns
        142 B
         314 B
         2
        2

        DNS Request

        26.35.223.20.in-addr.arpa

        DNS Request

        26.35.223.20.in-addr.arpa

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        126 B
         246 B
         2
        2

        DNS Request

        mr-bean.no-ip.org

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        126 B
         246 B
         2
        2

        DNS Request

        mr-bean.no-ip.org

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        126 B
         246 B
         2
        2

        DNS Request

        mr-bean.no-ip.org

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        126 B
         246 B
         2
        2

        DNS Request

        mr-bean.no-ip.org

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        126 B
         246 B
         2
        2

        DNS Request

        mr-bean.no-ip.org

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        126 B
         246 B
         2
        2

        DNS Request

        mr-bean.no-ip.org

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        126 B
         246 B
         2
        2

        DNS Request

        mr-bean.no-ip.org

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        126 B
         246 B
         2
        2

        DNS Request

        mr-bean.no-ip.org

        DNS Request

        mr-bean.no-ip.org

      • 8.8.8.8:53
        mr-bean.no-ip.org
        dns
        explorer.exe
        126 B
         246 B
         2
        2

        DNS Request

        mr-bean.no-ip.org

        DNS Request

        mr-bean.no-ip.org

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\InstallDir\Server.exe
        Filesize

        75KB

        MD5

        615980974c3cd0617493683e879293a4

        SHA1

        5059f260284f55c869b7ec4d2b6cc1875f66b422

        SHA256

        fcbf515ddd19f888f892cddbebfab9d9c666d2eb4afde374fee8d1128cf89d3a

        SHA512

        bb5ef9a1e8710a3b38f3b6d908cb46f10aa7831108bd1c169da3de427d440907d924635e47ec2eb8eb663e1ad4246d952fa2d77aecedc2abd2ae863e58daf31c

        Download Submit

      • memory/1508-0-0x0000000000C80000-0x0000000000C95000-memory.dmp

        Filesize

        84KB

        Download

      • memory/1508-7-0x0000000000C80000-0x0000000000C95000-memory.dmp

        Filesize

        84KB

        Download

      • memory/3048-4-0x0000000000C80000-0x0000000000C95000-memory.dmp

        Filesize

        84KB

        Download

      • memory/4108-6-0x0000000000C80000-0x0000000000C95000-memory.dmp

        Filesize

        84KB

        Download

      • memory/4108-9-0x0000000000C80000-0x0000000000C95000-memory.dmp

        Filesize

        84KB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.