Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

63ebf64aea...18.exe

windows7-x64

10

63ebf64aea...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/10/2024, 19:31 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    63ebf64aea416da73b78c128bd0de978_JaffaCakes118.exe

  • Size

    65KB

  • MD5

    63ebf64aea416da73b78c128bd0de978

  • SHA1

    25cfb9cbbad8a3415b800973c430f61e45f0e6c0

  • SHA256

    0178e0072fa6bd34a21af2edf4182deb0e3df20b11b9a31794da6cf98d5a5de0

  • SHA512

    e07b0beac0743da6e9d8b28acb860d7795a4ac2b56108d41ac5f7c40097829472f4fd6503a313ff94e95216bca3b4affa4fe2d21e2a98d61c29c65a8ab336117

  • SSDEEP

    1536:elB1zq+5hRpfvE7IxEos7PcF+KPmfRuUf/cDJUw9n6ns+jdzAqjq4yvGp:ezxEVPA+qmfR5CJUxs+SQeGp

Score
10/10
ponycredential_accessdefense_evasiondiscoverypersistenceratspywarestealerupx

Malware Config

Extracted

Family

pony

C2

http://jarkiy.info:2346/porno.php

http://sulikg.info:2346/porno.php

Signatures

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Drops file in Drivers directory 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs
    defense_evasion
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\63ebf64aea416da73b78c128bd0de978_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\63ebf64aea416da73b78c128bd0de978_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:852
    • \??\c:\users\admin\appdata\local\temp\63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
      "c:\users\admin\appdata\local\temp\63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe"
      2⤵
      • Drops file in Drivers directory
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4800
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c copy %WINDIR%\system32\drivers\etc\hosts %WINDIR%\system32\drivers\etc\hosts.sam /Y && at 19:34:00 cmd.exe /c copy %TEMP%\240626265FdOh %WINDIR%\system32\drivers\etc\hosts /Y
        3⤵
        • Drops file in Drivers directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4132
        • C:\Windows\SysWOW64\at.exe
          at 19:34:00 cmd.exe /c copy C:\Users\Admin\AppData\Local\Temp\240626265FdOh C:\Windows\system32\drivers\etc\hosts /Y
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4804
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\windows\CurrentVersion\Run /v 240626546 /t REG_SZ /d "cmd.exe /c copy %TEMP%\240626265FdOh %WINDIR%\system32\drivers\etc\hosts /Y && attrib +H %WINDIR%\system32\drivers\etc\hosts /f
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2848
        • C:\Windows\SysWOW64\reg.exe
          reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\windows\CurrentVersion\Run /v 240626546 /t REG_SZ /d "cmd.exe /c copy C:\Users\Admin\AppData\Local\Temp\240626265FdOh C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts /f
          4⤵
          • Adds Run key to start application
          • Hide Artifacts: Hidden Files and Directories
          • System Location Discovery: System Language Discovery
          PID:2812
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c ping -n 10 127.0.0.1 > NUL && del "c:\users\admin\appdata\local\temp\63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:4040
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 10 127.0.0.1
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2464

Network

  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    67.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    67.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    22.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    22.160.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    jarkiy.info
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    jarkiy.info
    IN A
    Response
  • flag-us
    DNS
    jarkiy.info
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    jarkiy.info
    IN A
    Response
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    jarkiy.info
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    jarkiy.info
    IN A
    Response
  • flag-us
    DNS
    jarkiy.info
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    jarkiy.info
    IN A
    Response
  • flag-us
    DNS
    jarkiy.info
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    jarkiy.info
    IN A
    Response
  • flag-us
    DNS
    jarkiy.info
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    jarkiy.info
    IN A
    Response
  • flag-us
    DNS
    jarkiy.info
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    jarkiy.info
    IN A
    Response
  • flag-us
    DNS
    sulikg.info
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    sulikg.info
    IN A
    Response
  • flag-us
    DNS
    sulikg.info
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    sulikg.info
    IN A
    Response
  • flag-us
    DNS
    53.210.109.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    53.210.109.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    sulikg.info
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    sulikg.info
    IN A
    Response
  • flag-us
    DNS
    66.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    66.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    sulikg.info
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    sulikg.info
    IN A
    Response
  • flag-us
    DNS
    sulikg.info
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    sulikg.info
    IN A
    Response
  • flag-us
    DNS
    sulikg.info
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    sulikg.info
    IN A
    Response
  • flag-us
    DNS
    sulikg.info
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    sulikg.info
    IN A
    Response
  • flag-us
    DNS
    sulikg.info
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    sulikg.info
    IN A
  • flag-us
    DNS
    sulikg.info
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    sulikg.info
    IN A
  • flag-us
    DNS
    73.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    58.99.105.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.99.105.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    22.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    22.236.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239339388162_1MFS3CT3ZOVTF7TJA&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239339388162_1MFS3CT3ZOVTF7TJA&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 731444
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 2ADE2F4FE5DD40728BE5311A68D19816 Ref B: LON601060102060 Ref C: 2024-10-20T19:33:05Z
    date: Sun, 20 Oct 2024 19:33:04 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239398629744_18YK2WB1TP6K8QRMK&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239398629744_18YK2WB1TP6K8QRMK&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 470956
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 2B01CADC3E3B401C9A31C11B079408B3 Ref B: LON601060102060 Ref C: 2024-10-20T19:33:05Z
    date: Sun, 20 Oct 2024 19:33:04 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239398629743_1TH437YUI5ZNDOHAL&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239398629743_1TH437YUI5ZNDOHAL&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 435129
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 2F5FD956168C4A0D9DC4ABCF1A11DC63 Ref B: LON601060102060 Ref C: 2024-10-20T19:33:05Z
    date: Sun, 20 Oct 2024 19:33:04 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340418581_1PW4UWMX6DVDU64ZR&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239340418581_1PW4UWMX6DVDU64ZR&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 315631
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 0EB1C5337707426FAB5BB56EE4C88263 Ref B: LON601060102060 Ref C: 2024-10-20T19:33:05Z
    date: Sun, 20 Oct 2024 19:33:04 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239339388161_17PDPNJBHCJYF0MEC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239339388161_17PDPNJBHCJYF0MEC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 871109
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 8F5C85B613AA436FB3FACBFDA91DD1C6 Ref B: LON601060102060 Ref C: 2024-10-20T19:33:05Z
    date: Sun, 20 Oct 2024 19:33:04 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340418582_18ZLZW09JZ7BHXRKX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239340418582_18ZLZW09JZ7BHXRKX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 241999
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 4F9BF397846C4C25B22D2CDAB1D4D855 Ref B: LON601060102060 Ref C: 2024-10-20T19:33:05Z
    date: Sun, 20 Oct 2024 19:33:04 GMT
  • flag-us
    DNS
    10.27.171.150.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    10.27.171.150.in-addr.arpa
    IN PTR
    Response
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 150.171.27.10:443
    https://tse1.mm.bing.net/th?id=OADD2.10239340418582_18ZLZW09JZ7BHXRKX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    tls, http2
    109.5kB
     3.2MB
     2316
    2309

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239339388162_1MFS3CT3ZOVTF7TJA&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239398629744_18YK2WB1TP6K8QRMK&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239398629743_1TH437YUI5ZNDOHAL&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418581_1PW4UWMX6DVDU64ZR&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239339388161_17PDPNJBHCJYF0MEC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418582_18ZLZW09JZ7BHXRKX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Response

    200
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    67.209.201.84.in-addr.arpa
    dns
    72 B
     132 B
     1
    1

    DNS Request

    67.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    22.160.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    22.160.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    jarkiy.info
    dns
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    114 B
     272 B
     2
    2

    DNS Request

    jarkiy.info

    DNS Request

    jarkiy.info

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    jarkiy.info
    dns
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    57 B
     136 B
     1
    1

    DNS Request

    jarkiy.info

  • 8.8.8.8:53
    jarkiy.info
    dns
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    57 B
     136 B
     1
    1

    DNS Request

    jarkiy.info

  • 8.8.8.8:53
    jarkiy.info
    dns
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    57 B
     136 B
     1
    1

    DNS Request

    jarkiy.info

  • 8.8.8.8:53
    jarkiy.info
    dns
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    57 B
     136 B
     1
    1

    DNS Request

    jarkiy.info

  • 8.8.8.8:53
    jarkiy.info
    dns
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    57 B
     136 B
     1
    1

    DNS Request

    jarkiy.info

  • 8.8.8.8:53
    sulikg.info
    dns
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    114 B
     272 B
     2
    2

    DNS Request

    sulikg.info

    DNS Request

    sulikg.info

  • 8.8.8.8:53
    53.210.109.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    53.210.109.20.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    210 B
     144 B
     3
    1

    DNS Request

    18.31.95.13.in-addr.arpa

    DNS Request

    18.31.95.13.in-addr.arpa

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    sulikg.info
    dns
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    57 B
     136 B
     1
    1

    DNS Request

    sulikg.info

  • 8.8.8.8:53
    66.209.201.84.in-addr.arpa
    dns
    72 B
     132 B
     1
    1

    DNS Request

    66.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    sulikg.info
    dns
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    57 B
     136 B
     1
    1

    DNS Request

    sulikg.info

  • 8.8.8.8:53
    sulikg.info
    dns
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    57 B
     136 B
     1
    1

    DNS Request

    sulikg.info

  • 8.8.8.8:53
    sulikg.info
    dns
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    57 B
     136 B
     1
    1

    DNS Request

    sulikg.info

  • 8.8.8.8:53
    sulikg.info
    dns
    63ebf64aea416da73b78c128bd0de978_jaffacakes118.exe
    171 B
     136 B
     3
    1

    DNS Request

    sulikg.info

    DNS Request

    sulikg.info

    DNS Request

    sulikg.info

  • 8.8.8.8:53
    73.209.201.84.in-addr.arpa
    dns
    72 B
     132 B
     1
    1

    DNS Request

    73.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    58.99.105.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    58.99.105.20.in-addr.arpa

  • 8.8.8.8:53
    22.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    22.236.111.52.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     170 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    150.171.27.10
    150.171.28.10

  • 8.8.8.8:53
    10.27.171.150.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    10.27.171.150.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Query Registry

2
T1012

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4800-0-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/4800-2-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/4800-4-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/4800-3-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/4800-8-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

  • memory/4800-14-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.