Network Analysis
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| 7tgopa.am.files.1drv.com |
CNAME
am-files.fe.1drv.com
CNAME
l-0003.l-msedge.net
|
13.107.42.12 |
| darkeye.hopto.org | 160.152.6.54 | |
| onedrive.live.com |
CNAME
l-0004.l-msedge.net
|
13.107.42.13 |
- UDP Requests
-
-
192.168.56.102:52062 164.124.101.2:53
-
192.168.56.102:52336 164.124.101.2:53
-
192.168.56.102:64034 164.124.101.2:53
-
192.168.56.102:64995 164.124.101.2:53
-
192.168.56.102:137 192.168.56.255:137
-
192.168.56.102:138 192.168.56.255:138
-
192.168.56.102:49152 239.255.255.250:3702
-
192.168.56.102:49164 239.255.255.250:1900
-
52.231.114.183:123 192.168.56.102:123
-
8.8.8.8:53 192.168.56.102:54322
-
8.8.8.8:53 192.168.56.102:58838
-
8.8.8.8:53 192.168.56.102:61115
-
8.8.8.8:53 192.168.56.102:64472
-
GET
302
https://onedrive.live.com/download?cid=6BC744122027ACE8&resid=6BC744122027ACE8%21137&authkey=AHDc8B9P60uuA9c
REQUEST
RESPONSE
BODY
GET /download?cid=6BC744122027ACE8&resid=6BC744122027ACE8%21137&authkey=AHDc8B9P60uuA9c HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: onedrive.live.com
Cache-Control: no-cache
HTTP/1.1 302 Found
Cache-Control: no-cache, no-store
Pragma: no-cache
Content-Type: text/html
Expires: -1
Location: https://7tgopa.am.files.1drv.com/y4mckn5MC3Qv-gVPVwFjos5tnqZQsy01f4ydquxfI_0P50St21A-sQTMObg1CL6lJZjE_lMc9Z9Ri15T28oKLIAo5_-35MWYEf-PuEl-SOXDH2MMxIbmE-fYjO37ArBfJT3n8GTS0IgVQ7ex0gTMVPcmk7D7BAckrNRkQ4SyrbBJthYXSeb8nQyfuiITS4ewOMyMYsvH7HaLu7Xvbbbg6Gtnw/LIGHT.bin?download&psid=1
Set-Cookie: E=P:W//TUO+C2Yg=:Wab9HUSgf/bDoD3PvZzW6jbValBLg6MV9Wq52sGQeRU=:F; domain=.live.com; path=/
Set-Cookie: xid=ed81e7b2-94ba-450a-8620-85ee556d9afd&&RD00155D7DC22C&317; domain=.live.com; path=/
Set-Cookie: xidseq=1; domain=.live.com; path=/
Set-Cookie: LD=; domain=.live.com; expires=Wed, 29-Sep-2021 00:37:41 GMT; path=/
Set-Cookie: wla42=; domain=live.com; expires=Wed, 06-Oct-2021 02:17:41 GMT; path=/
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000
X-MSNServer: RD00155D7DC22C
X-ODWebServer: canadacentral1-odwebpl
X-Cache: CONFIG_NOCACHE
X-MSEdge-Ref: Ref A: 1E817FBF287B4F3BA83F8121572FC45E Ref B: SLAEDGE1007 Ref C: 2021-09-29T02:17:41Z
Date: Wed, 29 Sep 2021 02:17:41 GMT
Content-Length: 0
GET
200
https://7tgopa.am.files.1drv.com/y4mckn5MC3Qv-gVPVwFjos5tnqZQsy01f4ydquxfI_0P50St21A-sQTMObg1CL6lJZjE_lMc9Z9Ri15T28oKLIAo5_-35MWYEf-PuEl-SOXDH2MMxIbmE-fYjO37ArBfJT3n8GTS0IgVQ7ex0gTMVPcmk7D7BAckrNRkQ4SyrbBJthYXSeb8nQyfuiITS4ewOMyMYsvH7HaLu7Xvbbbg6Gtnw/LIGHT.bin?download&psid=1
REQUEST
RESPONSE
BODY
GET /y4mckn5MC3Qv-gVPVwFjos5tnqZQsy01f4ydquxfI_0P50St21A-sQTMObg1CL6lJZjE_lMc9Z9Ri15T28oKLIAo5_-35MWYEf-PuEl-SOXDH2MMxIbmE-fYjO37ArBfJT3n8GTS0IgVQ7ex0gTMVPcmk7D7BAckrNRkQ4SyrbBJthYXSeb8nQyfuiITS4ewOMyMYsvH7HaLu7Xvbbbg6Gtnw/LIGHT.bin?download&psid=1 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Connection: Keep-Alive
Cache-Control: no-cache
Host: 7tgopa.am.files.1drv.com
HTTP/1.1 200 OK
Cache-Control: public
Content-Length: 207936
Content-Type: application/octet-stream
Content-Location: https://7tgopa.am.files.1drv.com/y4mFf5C4MCS194kan4lEo6NA0VJVUfJRdzLN8ykAxGV22dEROiAmjOBHW8rcaB2sGooUw1sJ4LUjhGZf9GaE1sOWDx0aFEvGsDaVj3Pzt2VlepqNhBQeyaRJ6ut1yllLRFo_aVM6XHBEtTDiSOhPz6zQt0NuHE7ZMhiLDG8g7NBNOHXezDqwvoyS7ZWrEtVxReW
Expires: Tue, 28 Dec 2021 02:17:42 GMT
Last-Modified: Fri, 27 Aug 2021 03:05:44 GMT
Accept-Ranges: bytes
ETag: 6BC744122027ACE8!137.2
P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
X-MSNSERVER: AM4SCH107020807
Strict-Transport-Security: max-age=31536000; includeSubDomains
MS-CV: a7f4imziZ0ywg9Wm0PDC2Q.0
X-SqlDataOrigin: S
CTag: aYzo2QkM3NDQxMjIwMjdBQ0U4ITEzNy4yNTc
X-PreAuthInfo: rv;poba;
Content-Disposition: attachment; filename="LIGHT.bin"
X-Content-Type-Options: nosniff
X-StreamOrigin: X
X-AsmVersion: UNKNOWN; 19.766.916.2003
X-Cache: CONFIG_NOCACHE
X-MSEdge-Ref: Ref A: D9E8249C0C3B45DC8E788F072DFC7CE5 Ref B: SLAEDGE1016 Ref C: 2021-09-29T02:17:41Z
Date: Wed, 29 Sep 2021 02:17:42 GMT
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.102:49165 -> 13.107.42.13:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.102:49167 -> 13.107.42.12:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| UDP 192.168.56.102:64472 -> 8.8.8.8:53 | 2028681 | ET POLICY DNS Query to DynDNS Domain *.hopto .org | Potentially Bad Traffic |
| UDP 192.168.56.102:54322 -> 8.8.8.8:53 | 2028681 | ET POLICY DNS Query to DynDNS Domain *.hopto .org | Potentially Bad Traffic |
| UDP 192.168.56.102:61115 -> 8.8.8.8:53 | 2028681 | ET POLICY DNS Query to DynDNS Domain *.hopto .org | Potentially Bad Traffic |
| UDP 192.168.56.102:58838 -> 8.8.8.8:53 | 2028681 | ET POLICY DNS Query to DynDNS Domain *.hopto .org | Potentially Bad Traffic |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.102:49165 13.107.42.13:443 |
C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01 | CN=onedrive.com | 50:2f:33:10:92:ac:27:7b:17:be:82:68:3b:e2:29:ad:97:41:b7:bb |
|
TLSv1 192.168.56.102:49167 13.107.42.12:443 |
C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01 | C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com | ec:e5:02:98:e6:c9:9a:12:fc:c0:4d:19:cd:2b:0c:ae:d0:c0:37:8e |
Snort Alerts
No Snort Alerts