Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| cacerts.digicert.com |
CNAME
cdn.digicertcdn.com
|
104.18.10.39 |
| dotnet.microsoft.com | 13.107.213.49 |
- TCP Requests
-
-
192.168.56.102:49843 104.18.10.39:80cacerts.digicert.com
-
192.168.56.102:49844 104.18.11.39:80cacerts.digicert.com
-
192.168.56.102:49846 117.18.232.200:80
-
192.168.56.102:49841 13.107.246.49:443dotnet.microsoft.com
-
192.168.56.102:49842 13.107.246.49:443dotnet.microsoft.com
-
192.168.56.102:49797 172.217.25.14:443
-
192.168.56.102:49835 23.197.161.201:80
-
192.168.56.102:49838 23.197.161.201:443
-
- UDP Requests
-
-
192.168.56.102:50839 164.124.101.2:53
-
192.168.56.102:54660 164.124.101.2:53
-
192.168.56.102:57660 164.124.101.2:53
-
192.168.56.102:61459 164.124.101.2:53
-
192.168.56.102:61998 164.124.101.2:53
-
192.168.56.102:137 192.168.56.255:137
-
192.168.56.102:138 192.168.56.255:138
-
192.168.56.102:49152 239.255.255.250:3702
-
192.168.56.102:56752 239.255.255.250:1900
-
192.168.56.102:56754 239.255.255.250:3702
-
192.168.56.102:56756 239.255.255.250:3702
-
192.168.56.102:56758 239.255.255.250:3702
-
GET
302
https://go.microsoft.com/fwlink/?linkid=850289&tfm=.NETFramework,Version=v4.6.1&processName=Svc_host.exe&platform=0009&osver=5&isServer=0
REQUEST
RESPONSE
BODY
GET /fwlink/?linkid=850289&tfm=.NETFramework,Version=v4.6.1&processName=Svc_host.exe&platform=0009&osver=5&isServer=0 HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: ko-KR
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept-Encoding: gzip, deflate
Host: go.microsoft.com
Connection: Keep-Alive
HTTP/1.1 302 Moved Temporarily
Location: https://dotnet.microsoft.com/get-dotnet/dotnet-framework?tfm=.NETFramework%2cVersion%3dv4.6.1&processName=Svc_host.exe&platform=0009&osver=5&isServer=0
Server: Kestrel
Request-Context: appId=cid-v1:26ef1154-5995-4d24-ad78-ef0b04f11587
X-Response-Cache-Status: True
X-Powered-By: ASP.NET
Content-Length: 0
Expires: Thu, 27 May 2021 08:38:50 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 27 May 2021 08:38:50 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
GET
302
http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.6.1&processName=Svc_host.exe&platform=0009&osver=5&isServer=0
REQUEST
RESPONSE
BODY
GET /fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.6.1&processName=Svc_host.exe&platform=0009&osver=5&isServer=0 HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: ko-KR
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept-Encoding: gzip, deflate
Host: go.microsoft.com
Connection: Keep-Alive
HTTP/1.1 302 Moved Temporarily
Location: https://go.microsoft.com/fwlink/?linkid=850289&tfm=.NETFramework,Version=v4.6.1&processName=Svc_host.exe&platform=0009&osver=5&isServer=0
Server: Kestrel
Request-Context: appId=cid-v1:9b037ab9-fa5a-4c09-81bd-41ffa859f01e
X-Response-Cache-Status: True
X-Powered-By: ASP.NET
Content-Length: 0
Expires: Thu, 27 May 2021 08:38:50 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 27 May 2021 08:38:50 GMT
Connection: keep-alive
GET
200
http://cacerts.digicert.com/DigiCertGlobalRootG2.crt
REQUEST
RESPONSE
BODY
GET /DigiCertGlobalRootG2.crt HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: cacerts.digicert.com
HTTP/1.1 200 OK
Date: Thu, 27 May 2021 08:38:50 GMT
Content-Type: application/pkix-cert
Content-Length: 914
Connection: keep-alive
Last-Modified: Wed, 06 Dec 2017 21:41:43 GMT
ETag: "5a286417-392"
Cache-Control: public, max-age=1209600
CF-Cache-Status: HIT
Age: 3955
Accept-Ranges: bytes
cf-request-id: 0a4e93049a0000618994864000000001
Server: cloudflare
CF-RAY: 655dede75b5d6189-ICN
GET
200
http://cacerts.digicert.com/DigiCertGlobalRootG2.crt
REQUEST
RESPONSE
BODY
GET /DigiCertGlobalRootG2.crt HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: cacerts.digicert.com
HTTP/1.1 200 OK
Date: Thu, 27 May 2021 08:38:50 GMT
Content-Type: application/pkix-cert
Content-Length: 914
Connection: keep-alive
Last-Modified: Wed, 06 Dec 2017 21:41:43 GMT
ETag: "5a286417-392"
Cache-Control: public, max-age=1209600
CF-Cache-Status: HIT
Age: 3955
Accept-Ranges: bytes
cf-request-id: 0a4e93049d000061cabb2b6000000001
Server: cloudflare
CF-RAY: 655dede76a4361ca-ICN
GET
200
http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
REQUEST
RESPONSE
BODY
GET /IE9CompatViewList.xml HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Host: ie9cvlist.ie.microsoft.com
If-Modified-Since: Fri, 16 Oct 2020 17:54:09 GMT
If-None-Match: 0x8D871FC7BDF491D
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Encoding: gzip
Age: 11608
Cache-Control: max-age=21600
Content-MD5: Ho7x5OFxPmXuon/IucKh7g==
Content-Type: text/xml
Date: Thu, 27 May 2021 08:39:49 GMT
Etag: 0x8D90364ECB23BC5
Last-Modified: Mon, 19 Apr 2021 18:57:05 GMT
Server: ECAcc (tka/897A)
Vary: Accept-Encoding
X-Cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: 97a71dfd-a01e-000e-43b8-520109000000
x-ms-version: 2009-09-19
Content-Length: 13706
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.102:49842 -> 13.107.246.49:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.102:49838 -> 23.197.161.201:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.102:49841 -> 13.107.246.49:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.102:49842 13.107.246.49:443 |
C=US, O=Microsoft Corporation, CN=Microsoft Azure TLS Issuing CA 05 | C=US, ST=WA, L=Redmond, O=Microsoft Corporation, CN=dotnet.microsoft.com | 84:70:00:ee:f5:ad:e7:a8:ba:80:02:e9:4b:27:5e:77:75:3b:31:d8 |
|
TLSv1 192.168.56.102:49838 23.197.161.201:443 |
C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01 | C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=go.microsoft.com | 88:c7:2f:7b:17:dd:89:49:46:0b:a2:3f:1b:26:80:82:24:cf:0b:58 |
|
TLSv1 192.168.56.102:49841 13.107.246.49:443 |
C=US, O=Microsoft Corporation, CN=Microsoft Azure TLS Issuing CA 05 | C=US, ST=WA, L=Redmond, O=Microsoft Corporation, CN=dotnet.microsoft.com | 84:70:00:ee:f5:ad:e7:a8:ba:80:02:e9:4b:27:5e:77:75:3b:31:d8 |
Snort Alerts
No Snort Alerts