Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03/11/2024, 17:33 UTC
Static task
static1
Behavioral task
behavioral1
Sample
8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe
-
Size
10.0MB
-
MD5
8cad62bca7d179852174d29df1b18d13
-
SHA1
d03e726c4f0d14f76ef200fc442507a327b5005b
-
SHA256
47234db90e903e55102e109e9054c59cb391c3c95f9fc34cacfe340cbac7f9df
-
SHA512
135b2c43776bde36d81f2f140865155e4f5a6f020c511f5b38c485bd4a0e60bafd5cb4fb517abca735b764abbb13cd90cfaf9e9b5336ca7d064a9d479e90436d
-
SSDEEP
196608:zllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllZ:zllllllllllllllllllllllllllllllZ
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Tofsee family
-
Creates new service(s) 2 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4864 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\uagefrlr\ImagePath = "C:\\Windows\\SysWOW64\\uagefrlr\\clxdnieu.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 820 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 1348 clxdnieu.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1348 set thread context of 820 1348 clxdnieu.exe 111 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4092 sc.exe 4084 sc.exe 4488 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 548 3532 WerFault.exe 83 4900 1348 WerFault.exe 102 -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clxdnieu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 3532 wrote to memory of 964 3532 8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe 87 PID 3532 wrote to memory of 964 3532 8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe 87 PID 3532 wrote to memory of 964 3532 8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe 87 PID 3532 wrote to memory of 3948 3532 8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe 90 PID 3532 wrote to memory of 3948 3532 8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe 90 PID 3532 wrote to memory of 3948 3532 8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe 90 PID 3532 wrote to memory of 4092 3532 8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe 94 PID 3532 wrote to memory of 4092 3532 8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe 94 PID 3532 wrote to memory of 4092 3532 8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe 94 PID 3532 wrote to memory of 4084 3532 8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe 96 PID 3532 wrote to memory of 4084 3532 8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe 96 PID 3532 wrote to memory of 4084 3532 8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe 96 PID 3532 wrote to memory of 4488 3532 8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe 99 PID 3532 wrote to memory of 4488 3532 8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe 99 PID 3532 wrote to memory of 4488 3532 8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe 99 PID 3532 wrote to memory of 4864 3532 8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe 103 PID 3532 wrote to memory of 4864 3532 8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe 103 PID 3532 wrote to memory of 4864 3532 8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe 103 PID 1348 wrote to memory of 820 1348 clxdnieu.exe 111 PID 1348 wrote to memory of 820 1348 clxdnieu.exe 111 PID 1348 wrote to memory of 820 1348 clxdnieu.exe 111 PID 1348 wrote to memory of 820 1348 clxdnieu.exe 111 PID 1348 wrote to memory of 820 1348 clxdnieu.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\uagefrlr\2⤵
- System Location Discovery: System Language Discovery
PID:964
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\clxdnieu.exe" C:\Windows\SysWOW64\uagefrlr\2⤵
- System Location Discovery: System Language Discovery
PID:3948
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create uagefrlr binPath= "C:\Windows\SysWOW64\uagefrlr\clxdnieu.exe /d\"C:\Users\Admin\AppData\Local\Temp\8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4092
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description uagefrlr "wifi internet conection"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4084
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start uagefrlr2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4488
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4864
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 6482⤵
- Program crash
PID:548
-
-
C:\Windows\SysWOW64\uagefrlr\clxdnieu.exeC:\Windows\SysWOW64\uagefrlr\clxdnieu.exe /d"C:\Users\Admin\AppData\Local\Temp\8cad62bca7d179852174d29df1b18d13_JaffaCakes118.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
- System Location Discovery: System Language Discovery
PID:820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 5202⤵
- Program crash
PID:4900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3532 -ip 35321⤵PID:1064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1348 -ip 13481⤵PID:4348
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request94.12.20.2.in-addr.arpaIN PTRResponse94.12.20.2.in-addr.arpaIN PTRa2-20-12-94deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.ax-0001.ax-msedge.netg-bing-com.ax-0001.ax-msedge.netIN CNAMEax-0001.ax-msedge.netax-0001.ax-msedge.netIN A150.171.28.10ax-0001.ax-msedge.netIN A150.171.27.10
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa62a24f7f454480a2d30d4483eb9a13&localId=w:66B95077-CF2F-5A7E-6FF7-2AB84BE1688C&deviceId=6896208602593836&anid=Remote address:150.171.28.10:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa62a24f7f454480a2d30d4483eb9a13&localId=w:66B95077-CF2F-5A7E-6FF7-2AB84BE1688C&deviceId=6896208602593836&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=1C7310D3574C6FEC1B6B05FF568E6E78; domain=.bing.com; expires=Fri, 28-Nov-2025 17:34:11 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7B745AC2B0494AFAA03DAB6CF79A23C6 Ref B: LON601060105062 Ref C: 2024-11-03T17:34:11Z
date: Sun, 03 Nov 2024 17:34:10 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=aa62a24f7f454480a2d30d4483eb9a13&localId=w:66B95077-CF2F-5A7E-6FF7-2AB84BE1688C&deviceId=6896208602593836&anid=Remote address:150.171.28.10:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=aa62a24f7f454480a2d30d4483eb9a13&localId=w:66B95077-CF2F-5A7E-6FF7-2AB84BE1688C&deviceId=6896208602593836&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=1C7310D3574C6FEC1B6B05FF568E6E78
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=F-EuSzj0LkDJkuM1ObGdSq7gO5F8Kg97q7V5LcxDk2Q; domain=.bing.com; expires=Fri, 28-Nov-2025 17:34:11 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 5376548293754167900DB1235F62BB04 Ref B: LON601060105062 Ref C: 2024-11-03T17:34:11Z
date: Sun, 03 Nov 2024 17:34:10 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa62a24f7f454480a2d30d4483eb9a13&localId=w:66B95077-CF2F-5A7E-6FF7-2AB84BE1688C&deviceId=6896208602593836&anid=Remote address:150.171.28.10:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa62a24f7f454480a2d30d4483eb9a13&localId=w:66B95077-CF2F-5A7E-6FF7-2AB84BE1688C&deviceId=6896208602593836&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=1C7310D3574C6FEC1B6B05FF568E6E78; MSPTC=F-EuSzj0LkDJkuM1ObGdSq7gO5F8Kg97q7V5LcxDk2Q
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7A9E5A7406C6455198CEBF2CBC808CA9 Ref B: LON601060105062 Ref C: 2024-11-03T17:34:11Z
date: Sun, 03 Nov 2024 17:34:10 GMT
-
Remote address:8.8.8.8:53Request20.160.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request10.28.171.150.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request58.99.105.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestmicrosoft.comIN AResponsemicrosoft.comIN A20.231.239.246microsoft.comIN A20.70.246.20microsoft.comIN A20.112.250.133microsoft.comIN A20.76.201.171microsoft.comIN A20.236.44.162
-
Remote address:8.8.8.8:53Requestmicrosoft.comIN MXResponsemicrosoft.comIN MXmicrosoft-commail protectionoutlook�
-
Remote address:8.8.8.8:53Requestmicrosoft-com.mail.protection.outlook.comIN AResponsemicrosoft-com.mail.protection.outlook.comIN A52.101.9.20microsoft-com.mail.protection.outlook.comIN A52.101.41.21microsoft-com.mail.protection.outlook.comIN A52.101.11.19microsoft-com.mail.protection.outlook.comIN A52.101.42.10
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request246.239.231.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestdefeatwax.ruIN AResponse
-
Remote address:8.8.8.8:53Requestdefeatwax.ruIN AResponse
-
Remote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestyahoo.comIN MXResponseyahoo.comIN MXmta7am0yahoodnsnetyahoo.comIN MXmta6�.yahoo.comIN MXmta5�.
-
Remote address:8.8.8.8:53Requestmta7.am0.yahoodns.netIN AResponsemta7.am0.yahoodns.netIN A67.195.228.106mta7.am0.yahoodns.netIN A67.195.228.110mta7.am0.yahoodns.netIN A98.136.96.91mta7.am0.yahoodns.netIN A67.195.204.72mta7.am0.yahoodns.netIN A98.136.96.74mta7.am0.yahoodns.netIN A67.195.204.74mta7.am0.yahoodns.netIN A98.136.96.77mta7.am0.yahoodns.netIN A98.136.96.76
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request101.11.19.2.in-addr.arpaIN PTRResponse101.11.19.2.in-addr.arpaIN PTRa2-19-11-101deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestdefeatwax.ruIN AResponse
-
Remote address:8.8.8.8:53Requestdefeatwax.ruIN AResponse
-
Remote address:8.8.8.8:53Requestgoogle.comIN MXResponsegoogle.comIN MXsmtp�
-
Remote address:8.8.8.8:53Requestsmtp.google.comIN AResponsesmtp.google.comIN A64.233.167.26smtp.google.comIN A64.233.166.26smtp.google.comIN A74.125.206.27smtp.google.comIN A74.125.206.26smtp.google.comIN A64.233.167.27
-
Remote address:8.8.8.8:53Requestdefeatwax.ruIN AResponse
-
Remote address:8.8.8.8:53Request97.12.20.2.in-addr.arpaIN PTRResponse97.12.20.2.in-addr.arpaIN PTRa2-20-12-97deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestrefabyd.infoIN AResponse
-
Remote address:8.8.8.8:53Requestmail.ruIN MXResponsemail.ruIN MXmxs�
-
Remote address:8.8.8.8:53Requestmxs.mail.ruIN AResponsemxs.mail.ruIN A217.69.139.150mxs.mail.ruIN A94.100.180.31
-
Remote address:8.8.8.8:53Requestrefabyd.infoIN AResponse
-
Remote address:8.8.8.8:53Requestrefabyd.infoIN AResponse
-
Remote address:8.8.8.8:53Request103.209.201.84.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request43.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestrefabyd.infoIN AResponse
-
Remote address:8.8.8.8:53Request55.36.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEax-0001.ax-msedge.netax-0001.ax-msedge.netIN A150.171.27.10ax-0001.ax-msedge.netIN A150.171.28.10
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239359666015_129MHZWWLTLOFKV34&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239359666015_129MHZWWLTLOFKV34&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 381097
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: FBE564710ACC43B5B091D1E5B4323685 Ref B: LON601060108036 Ref C: 2024-11-03T17:35:45Z
date: Sun, 03 Nov 2024 17:35:44 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301359_1MPAZ60VREACMMWNW&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239317301359_1MPAZ60VREACMMWNW&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 577346
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: EAC110E5B8E441C8BB4952DB5DACBFCD Ref B: LON601060108036 Ref C: 2024-11-03T17:35:45Z
date: Sun, 03 Nov 2024 17:35:44 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340418539_1KFG8UNZE5MUR2Y24&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239340418539_1KFG8UNZE5MUR2Y24&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 733458
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: E13F5C2C4A3E45EF8DFAE3CF7A114ADF Ref B: LON601060108036 Ref C: 2024-11-03T17:35:45Z
date: Sun, 03 Nov 2024 17:35:44 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317300926_1VTZCQ3RYKOOL9YNI&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239317300926_1VTZCQ3RYKOOL9YNI&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 466066
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 0D9268716C064C00B6900E9E73F5E4E3 Ref B: LON601060108036 Ref C: 2024-11-03T17:35:45Z
date: Sun, 03 Nov 2024 17:35:44 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239359666014_184L10ZBQ5IURAGOY&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239359666014_184L10ZBQ5IURAGOY&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 425397
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 44FE18B18B174FAFB249832EE7D0F022 Ref B: LON601060108036 Ref C: 2024-11-03T17:35:45Z
date: Sun, 03 Nov 2024 17:35:44 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340418540_1UQTKN6JO04LNXB5Q&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239340418540_1UQTKN6JO04LNXB5Q&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 676162
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F65F47219C234456BEA1AA3B9B04E3B2 Ref B: LON601060108036 Ref C: 2024-11-03T17:35:45Z
date: Sun, 03 Nov 2024 17:35:44 GMT
-
Remote address:8.8.8.8:53Requestrefabyd.infoIN AResponse
-
Remote address:8.8.8.8:53Requestdefeatwax.ruIN AResponse
-
Remote address:8.8.8.8:53Requestdefeatwax.ruIN AResponse
-
Remote address:8.8.8.8:53Requestdefeatwax.ruIN AResponse
-
Remote address:8.8.8.8:53Requestdefeatwax.ruIN AResponse
-
Remote address:8.8.8.8:53Requestdefeatwax.ruIN AResponse
-
Remote address:8.8.8.8:53Requestdefeatwax.ruIN AResponse
-
Remote address:8.8.8.8:53Requestdefeatwax.ruIN AResponse
-
Remote address:8.8.8.8:53Requestdefeatwax.ruIN AResponse
-
150.171.28.10:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa62a24f7f454480a2d30d4483eb9a13&localId=w:66B95077-CF2F-5A7E-6FF7-2AB84BE1688C&deviceId=6896208602593836&anid=tls, http22.0kB 9.4kB 22 20
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa62a24f7f454480a2d30d4483eb9a13&localId=w:66B95077-CF2F-5A7E-6FF7-2AB84BE1688C&deviceId=6896208602593836&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=aa62a24f7f454480a2d30d4483eb9a13&localId=w:66B95077-CF2F-5A7E-6FF7-2AB84BE1688C&deviceId=6896208602593836&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=aa62a24f7f454480a2d30d4483eb9a13&localId=w:66B95077-CF2F-5A7E-6FF7-2AB84BE1688C&deviceId=6896208602593836&anid=HTTP Response
204 -
190 B 132 B 4 3
-
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
1.2kB 6.9kB 15 13
-
1.2kB 6.9kB 15 13
-
1.2kB 6.9kB 15 13
-
150.171.27.10:443https://tse1.mm.bing.net/th?id=OADD2.10239340418540_1UQTKN6JO04LNXB5Q&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90tls, http2126.1kB 3.4MB 2487 2481
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239359666015_129MHZWWLTLOFKV34&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301359_1MPAZ60VREACMMWNW&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340418539_1KFG8UNZE5MUR2Y24&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317300926_1VTZCQ3RYKOOL9YNI&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239359666014_184L10ZBQ5IURAGOY&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340418540_1UQTKN6JO04LNXB5Q&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Response
200 -
1.2kB 6.9kB 15 13
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
28.118.140.52.in-addr.arpa
-
69 B 131 B 1 1
DNS Request
94.12.20.2.in-addr.arpa
-
56 B 148 B 1 1
DNS Request
g.bing.com
DNS Response
150.171.28.10150.171.27.10
-
72 B 158 B 1 1
DNS Request
20.160.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
10.28.171.150.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
58.99.105.20.in-addr.arpa
-
59 B 139 B 1 1
DNS Request
microsoft.com
DNS Response
20.231.239.24620.70.246.2020.112.250.13320.76.201.17120.236.44.162
-
59 B 113 B 1 1
DNS Request
microsoft.com
-
87 B 151 B 1 1
DNS Request
microsoft-com.mail.protection.outlook.com
DNS Response
52.101.9.2052.101.41.2152.101.11.1952.101.42.10
-
73 B 147 B 1 1
DNS Request
104.219.191.52.in-addr.arpa
-
73 B 159 B 1 1
DNS Request
246.239.231.20.in-addr.arpa
-
58 B 119 B 1 1
DNS Request
defeatwax.ru
-
58 B 119 B 1 1
DNS Request
defeatwax.ru
-
70 B 156 B 1 1
DNS Request
50.23.12.20.in-addr.arpa
-
55 B 134 B 1 1
DNS Request
yahoo.com
-
67 B 195 B 1 1
DNS Request
mta7.am0.yahoodns.net
DNS Response
67.195.228.10667.195.228.11098.136.96.9167.195.204.7298.136.96.7467.195.204.7498.136.96.7798.136.96.76
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
101.11.19.2.in-addr.arpa
-
58 B 119 B 1 1
DNS Request
defeatwax.ru
-
58 B 119 B 1 1
DNS Request
defeatwax.ru
-
56 B 77 B 1 1
DNS Request
google.com
-
61 B 141 B 1 1
DNS Request
smtp.google.com
DNS Response
64.233.167.2664.233.166.2674.125.206.2774.125.206.2664.233.167.27
-
58 B 119 B 1 1
DNS Request
defeatwax.ru
-
69 B 131 B 1 1
DNS Request
97.12.20.2.in-addr.arpa
-
58 B 137 B 1 1
DNS Request
refabyd.info
-
53 B 73 B 1 1
DNS Request
mail.ru
-
57 B 89 B 1 1
DNS Request
mxs.mail.ru
DNS Response
217.69.139.15094.100.180.31
-
58 B 137 B 1 1
DNS Request
refabyd.info
-
58 B 137 B 1 1
DNS Request
refabyd.info
-
73 B 133 B 1 1
DNS Request
103.209.201.84.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
43.229.111.52.in-addr.arpa
-
58 B 137 B 1 1
DNS Request
refabyd.info
-
71 B 157 B 1 1
DNS Request
55.36.223.20.in-addr.arpa
-
62 B 170 B 1 1
DNS Request
tse1.mm.bing.net
DNS Response
150.171.27.10150.171.28.10
-
58 B 137 B 1 1
DNS Request
refabyd.info
-
116 B 238 B 2 2
DNS Request
defeatwax.ru
DNS Request
defeatwax.ru
-
116 B 238 B 2 2
DNS Request
defeatwax.ru
DNS Request
defeatwax.ru
-
116 B 238 B 2 2
DNS Request
defeatwax.ru
DNS Request
defeatwax.ru
-
116 B 238 B 2 2
DNS Request
defeatwax.ru
DNS Request
defeatwax.ru
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.5MB
MD543edf8c690e7bee9684224c34d6e4bf9
SHA106aff3b0edd8fdf6408d47bd6e354e878b13956a
SHA256425ca1d2f0e1c2513aacb9372c3784ab7f1288e66db65f2e9a0563d173c8780b
SHA512f0ae0ec4802ae05aec2a1d3c1e39fa60d02292c4dfa5db59dfb5dcebaa73edadf2c6803b8e1d303d7d072e7e950a23d380eae80420da8d23b061d8fdc4fa8477