Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

7bbb21be53...18.exe

windows7-x64

10

7bbb21be53...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    133s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2024, 04:06 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe

  • Size

    80KB

  • MD5

    7bbb21be53c647bc53402ac1eb50118b

  • SHA1

    4866ec28b1a3a208709a2ce47960f19ad57b6de2

  • SHA256

    ad13568a9aeef6cb8d46abba55258736cbd97896ec874543b74af27dfa54bf94

  • SHA512

    449efa873ac5cdf9d147ed60859a963cf79fc7f4c4bed70740e74e79b1b9e4e80407c3787fe68a5ecbf0578d06a00b54c98562b0f4b9c74ecab8f5b9b7f6d7e6

  • SSDEEP

    1536:8zcC/IHgPU84bl281nXYhBxRelnFGRnXxIGmaeQe95DNSquOLiYt/W:8zcSmsUpl281nXYFRePGRn7FevcfOLBU

Score
10/10
ponycredential_accessdefense_evasiondiscoverypersistenceratspywarestealerupx

Malware Config

Extracted

Family

pony

C2

http://klearcity.info:2346/pony/mac.php

http://slomtexs.info:2346/pony/mac.php

Signatures

  • Pony family
    pony
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs
    defense_evasion
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c at 04:10:00 cmd.exe /c copy %TEMP%\240676968FdOh %WINDIR%\system32\drivers\etc\hosts /Y && rename %WINDIR%\system32\drivers\etc\hosts hosts.sys
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2900
      • C:\Windows\SysWOW64\at.exe
        at 04:10:00 cmd.exe /c copy C:\Users\Admin\AppData\Local\Temp\240676968FdOh C:\Windows\system32\drivers\etc\hosts /Y
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2392
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\windows\CurrentVersion\Run /v 240677265 /t REG_SZ /d "cmd.exe /c copy %TEMP%\240676968FdOh %WINDIR%\system32\drivers\etc\hosts /Y && attrib +H %WINDIR%\system32\drivers\etc\hosts /f
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:948
      • C:\Windows\SysWOW64\reg.exe
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\windows\CurrentVersion\Run /v 240677265 /t REG_SZ /d "cmd.exe /c copy C:\Users\Admin\AppData\Local\Temp\240676968FdOh C:\Windows\system32\drivers\etc\hosts /Y && attrib +H C:\Windows\system32\drivers\etc\hosts /f
        3⤵
        • Adds Run key to start application
        • Hide Artifacts: Hidden Files and Directories
        • System Location Discovery: System Language Discovery
        PID:5068
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\abcd.bat" "C:\Users\Admin\AppData\Local\Temp\7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1860

Network

  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    77.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    77.190.18.2.in-addr.arpa
    IN PTR
    Response
    77.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-77deploystaticakamaitechnologiescom
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    klearcity.info
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    klearcity.info
    IN A
    Response
  • flag-us
    DNS
    klearcity.info
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    klearcity.info
    IN A
    Response
  • flag-us
    DNS
    klearcity.info
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    klearcity.info
    IN A
    Response
  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    klearcity.info
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    klearcity.info
    IN A
    Response
  • flag-us
    DNS
    klearcity.info
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    klearcity.info
    IN A
    Response
  • flag-us
    DNS
    klearcity.info
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    klearcity.info
    IN A
    Response
  • flag-us
    DNS
    slomtexs.info
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    slomtexs.info
    IN A
    Response
  • flag-us
    DNS
    53.210.109.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    53.210.109.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    slomtexs.info
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    slomtexs.info
    IN A
    Response
  • flag-us
    DNS
    slomtexs.info
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    slomtexs.info
    IN A
    Response
  • flag-us
    DNS
    slomtexs.info
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    slomtexs.info
    IN A
    Response
  • flag-us
    DNS
    slomtexs.info
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    slomtexs.info
    IN A
    Response
  • flag-us
    DNS
    slomtexs.info
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    Remote address:
    8.8.8.8:53
    Request
    slomtexs.info
    IN A
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239339388086_17JQXLT19NWNE8CIT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239339388086_17JQXLT19NWNE8CIT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 1036625
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 4E59C98D5DE444F480E9B7E57A4AB97D Ref B: LON601060104029 Ref C: 2024-10-29T04:07:59Z
    date: Tue, 29 Oct 2024 04:07:58 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301544_150BJDG31FJ0ZNF34&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239317301544_150BJDG31FJ0ZNF34&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 312790
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 13AC443006ED4D3D80F36A6382B5FE8F Ref B: LON601060104029 Ref C: 2024-10-29T04:07:59Z
    date: Tue, 29 Oct 2024 04:07:58 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360433542_1UJC4903W7XNIUU73&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239360433542_1UJC4903W7XNIUU73&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 843567
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 286F7494161C41739C768D6A09A8BBEE Ref B: LON601060104029 Ref C: 2024-10-29T04:07:59Z
    date: Tue, 29 Oct 2024 04:07:58 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301111_1DKW3SIPELFG6R5I0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239317301111_1DKW3SIPELFG6R5I0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 298506
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: E9ED3127C5944DA59B2B22FF58D432C4 Ref B: LON601060104029 Ref C: 2024-10-29T04:07:59Z
    date: Tue, 29 Oct 2024 04:07:58 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239339388085_1V9VP4ET8MMYG3B93&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239339388085_1V9VP4ET8MMYG3B93&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 1266902
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 949516AFB16143DAAE5456EDB3FA1388 Ref B: LON601060104029 Ref C: 2024-10-29T04:07:59Z
    date: Tue, 29 Oct 2024 04:07:58 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360433543_1F4HJPO10Z3VYH0SK&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239360433543_1F4HJPO10Z3VYH0SK&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 688476
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 014CCBD2D70C4996AD5DCEDFC4AC0063 Ref B: LON601060104029 Ref C: 2024-10-29T04:08:00Z
    date: Tue, 29 Oct 2024 04:08:00 GMT
  • flag-us
    DNS
    55.36.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    55.36.223.20.in-addr.arpa
    IN PTR
    Response
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     16
    13
  • 150.171.27.10:443
    https://tse1.mm.bing.net/th?id=OADD2.10239360433543_1F4HJPO10Z3VYH0SK&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    tls, http2
    156.5kB
     4.6MB
     3358
    3351

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239339388086_17JQXLT19NWNE8CIT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301544_150BJDG31FJ0ZNF34&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360433542_1UJC4903W7XNIUU73&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301111_1DKW3SIPELFG6R5I0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239339388085_1V9VP4ET8MMYG3B93&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360433543_1F4HJPO10Z3VYH0SK&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    77.190.18.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    77.190.18.2.in-addr.arpa

  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    klearcity.info
    dns
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    60 B
     139 B
     1
    1

    DNS Request

    klearcity.info

  • 8.8.8.8:53
    klearcity.info
    dns
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    60 B
     139 B
     1
    1

    DNS Request

    klearcity.info

  • 8.8.8.8:53
    klearcity.info
    dns
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    60 B
     139 B
     1
    1

    DNS Request

    klearcity.info

  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    klearcity.info
    dns
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    60 B
     139 B
     1
    1

    DNS Request

    klearcity.info

  • 8.8.8.8:53
    klearcity.info
    dns
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    60 B
     139 B
     1
    1

    DNS Request

    klearcity.info

  • 8.8.8.8:53
    klearcity.info
    dns
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    60 B
     139 B
     1
    1

    DNS Request

    klearcity.info

  • 8.8.8.8:53
    slomtexs.info
    dns
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    59 B
     138 B
     1
    1

    DNS Request

    slomtexs.info

  • 8.8.8.8:53
    53.210.109.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    53.210.109.20.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    slomtexs.info
    dns
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    59 B
     138 B
     1
    1

    DNS Request

    slomtexs.info

  • 8.8.8.8:53
    slomtexs.info
    dns
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    59 B
     138 B
     1
    1

    DNS Request

    slomtexs.info

  • 8.8.8.8:53
    slomtexs.info
    dns
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    59 B
     138 B
     1
    1

    DNS Request

    slomtexs.info

  • 8.8.8.8:53
    slomtexs.info
    dns
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    59 B
     138 B
     1
    1

    DNS Request

    slomtexs.info

  • 8.8.8.8:53
    slomtexs.info
    dns
    7bbb21be53c647bc53402ac1eb50118b_JaffaCakes118.exe
    59 B
     138 B
     1
    1

    DNS Request

    slomtexs.info

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    30.243.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    30.243.111.52.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     170 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    150.171.27.10
    150.171.28.10

  • 8.8.8.8:53
    55.36.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    55.36.223.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\abcd.bat
    Filesize

    75B

    MD5

    0849cfe65b98ba5fcd9a9ec61a671d09

    SHA1

    9d0ccb383c32b1bc07fd9064b9324a18e1276902

    SHA256

    44f6a1e48081deccfb61075e585bcb36c6d8e8feeb6ebae50bab41677822c643

    SHA512

    afdeda8122b4cefcf7549018c40d3142985e88a6d8f13eb58e9a59aa312b73608123de5f9feebc2ce25b6ec215d23c324b9f3a9a0e97041d67d863a25e15e57a

    Download Submit

  • memory/2124-0-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/2124-1-0x000000000040E000-0x0000000000413000-memory.dmp

    Filesize

    20KB

    Download

  • memory/2124-2-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/2124-3-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/2124-4-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/2124-5-0x000000000040E000-0x0000000000413000-memory.dmp

    Filesize

    20KB

    Download

  • memory/2124-15-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.