| Category | Machine | Started | Completed |
|---|---|---|---|
| URL | s1_win7_x6401 | June 18, 2024, 10:27 p.m. | June 18, 2024, 10:29 p.m. |
| URL | https://qrco.de/bfAK2I?onO=XTpHzVDAeO?WTh=1XXH9na1GN |
|---|
-
iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" https://qrco.de/bfAK2I?onO=XTpHzVDAeO?WTh=1XXH9na1GN
2616-
iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2616 CREDAT:145409
2700
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| apps.identrust.com |
CNAME
a1952.dscq.akamai.net
CNAME
identrust.edgesuite.net
|
23.32.56.72 |
| qrcg-registry.qr-code-generator.com | 54.230.176.84 | |
| qrco.de | 13.225.131.84 | |
| cdnjs.cloudflare.com | 104.17.25.14 |
Suricata Alerts
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.101:49165 13.225.131.87:443 |
C=US, O=Amazon, CN=Amazon RSA 2048 M03 | CN=qrco.de | 6e:b8:25:a4:ce:d8:a2:58:97:83:2f:61:ab:18:2e:a6:bb:13:ee:69 |
|
TLSv1 192.168.56.101:49164 13.225.131.87:443 |
C=US, O=Amazon, CN=Amazon RSA 2048 M03 | CN=qrco.de | 6e:b8:25:a4:ce:d8:a2:58:97:83:2f:61:ab:18:2e:a6:bb:13:ee:69 |
|
TLSv1 192.168.56.101:49169 54.230.176.21:443 |
C=US, O=Amazon, CN=Amazon RSA 2048 M02 | CN=qrcg-registry.qr-code-generator.com | 90:91:de:6a:37:40:5c:6b:82:d9:26:4f:7f:f4:db:c1:e5:15:83:a9 |
|
TLSv1 192.168.56.101:49167 104.17.25.14:443 |
C=US, O=Let's Encrypt, CN=R3 | CN=cdnjs.cloudflare.com | d2:ad:d7:fd:89:73:53:92:b8:97:c0:9e:64:3b:b4:1f:a2:d7:ac:9b |
|
TLSv1 192.168.56.101:49170 54.230.176.21:443 |
C=US, O=Amazon, CN=Amazon RSA 2048 M02 | CN=qrcg-registry.qr-code-generator.com | 90:91:de:6a:37:40:5c:6b:82:d9:26:4f:7f:f4:db:c1:e5:15:83:a9 |
|
TLSv1 192.168.56.101:49168 104.17.25.14:443 |
C=US, O=Let's Encrypt, CN=R3 | CN=cdnjs.cloudflare.com | d2:ad:d7:fd:89:73:53:92:b8:97:c0:9e:64:3b:b4:1f:a2:d7:ac:9b |
|
TLSv1 192.168.56.101:49174 13.225.131.87:443 |
C=US, O=Amazon, CN=Amazon RSA 2048 M03 | CN=qrco.de | 6e:b8:25:a4:ce:d8:a2:58:97:83:2f:61:ab:18:2e:a6:bb:13:ee:69 |
|
TLSv1 192.168.56.101:49173 13.225.131.87:443 |
C=US, O=Amazon, CN=Amazon RSA 2048 M03 | CN=qrco.de | 6e:b8:25:a4:ce:d8:a2:58:97:83:2f:61:ab:18:2e:a6:bb:13:ee:69 |
| request | GET http://apps.identrust.com/roots/dstrootcax3.p7c |
| request | GET http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml |
| request | GET https://qrco.de/bfAK2I?onO=XTpHzVDAeO?WTh=1XXH9na1GN |
| request | GET https://qrco.de/css/build/smartphone-preview.min.css |
| request | GET https://qrcg-registry.qr-code-generator.com/qrapp-legacy-webcomponents/qrcg.min.js |
| request | GET https://qrco.de/favicon.ico |
| file | C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\qrcg.min[1].js |
| url | https://ssl.pstatic.net/tveta/libs/1287/1287046/6df1cc02334922baa2d4_20200806172035021.jpg |
| url | https://ssl.pstatic.net/static/pwe/common/img_use_mobile_version.png |
| url | http://uk.ask.com/favicon.ico |
| url | https://fonts.gstatic.com/s/lato/v16/S6uyw4BMUTPHjx4wWA.woff |
| url | http://crl.identrust.com/DSTROOTCAX3CRL.crl0 |
| url | https://s.pstatic.net/static/newsstand/2020/logo/light/0604/477.png |
| url | http://www.cnet.com/favicon.ico |
| url | http://crl |
| url | https://castbox.shopping.naver.com/js/lazyload.js |
| url | https://s.pstatic.net/shopping.phinf/20200729_1/2931dd60-1842-4048-a39c-1e3389db4a0e.jpg |
| url | http://search.hanafos.com/favicon.ico |
| url | https://ssl.pstatic.net/tveta/libs/1298/1298853/743c01d46e807a376d99_20200730182507675.png |
| url | https://s.pstatic.net/static/newsstand/2020/logo/light/0604/820.png |
| url | http://search.livedoor.com/favicon.ico |
| url | https://file-examples-com.github.io/uploads/2017/02/file-sample_1MB.doc |
| url | https://s.pstatic.net/shopping.phinf/20211025_16/fb4391ad-80a4-4058-a54e-c294a35d0275.jpg?type=f214_292 |
| url | http://blogimgs.naver.com/nblog/skins/happybean/bg-head.gif |
| url | http://www.amazon.co.jp/ |
| url | http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab |
| url | http://yellowpages.superpages.com/ |
| url | https://www.naver.com |
| url | https://s.pstatic.net/shopping.phinf/20211028_9/adf7905c-28ea-4ddf-93b2-aa96dad57752.jpg |
| url | https://s.pstatic.net/shopping.phinf/20200806_26/3cad46ab-3fa4-4756-9e01-d61372890bd0.jpg |
| url | https://s.pstatic.net/dthumb.phinf/?src=%22http%3A%2F%2Fstatic.naver.net%2Fwww%2Fmobile%2Fedit%2F2020%2F0804%2Fmobile_212629657646c.jpg%22 |
| url | https://my.sendinblue.com/public/theme/version4/assets/images/loader_sblue.gif |
| url | https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F20211029_1095%2Fupload_163546934024588ZQX.jpg%22 |
| url | https://ssl.pstatic.net/static/pwe/nm/sp_mail_setup_140716.png |
| url | http://search.sify.com/ |
| url | https://s.pstatic.net/static/newsstand/2020/logo/light/0604/410.png |
| url | http://search.msn.com/results.aspx?q= |
| url | https://s.pstatic.net/shopping.phinf/20200731_21/4628ed28-27dc-4586-871c-f7f22524da89.jpg?type=f214_292 |
| url | https://s.pstatic.net/imgshopping/static/sb/js/sb/nclktagS01_v1.js?v=2020080314 |
| url | https://ssl.pstatic.net/tveta/libs/1299/1299024/c033376e145702a0a471_20200806171156016.jpg |
| url | https://fonts.googleapis.com/css?family=Open |
| url | http://isrg.trustid.ocsp.identrust.com0 |
| url | http://crl.usertrust.com/U |
| url | http://si.wikipedia.org/w/api.php?action=opensearch |
| url | http://www.signatur.rtr.at/de/directory/cps.html0 |
| url | http://search.ebay.fr/ |
| url | https://s.pstatic.net/static/newsstand/2020/logo/light/0604/921.png |
| url | https://file-examples.com/wp-content/themes/file-examples/vendor/font-awesome/fonts/fontawesome-webfont.eot? |
| url | http://www.certplus.com/CRL/class3TS.crl0 |
| url | https://s.pstatic.net/shopping.phinf/20200603_16/34b72b79-bb6a-40b2-b35d-ae82e0ee5115.jpg |
| url | http://it.wikipedia.org/favicon.ico |
| url | http://uk.ask.com/ |
| url | https://fonts.gstatic.com/s/muli/v22/7Aulp_0qiz-aVz7u3PJLcUMYOFnOkEk30e4.woff |
| url | https://s.pstatic.net/dthumb.phinf/?src=%22https%3A%2F%2Fs.pstatic.net%2Fstatic%2Fwww%2Fmobile%2Fedit%2F20211027_1095%2Fupload_1635293110459bqWPi.jpg%22 |
| url | https://s.pstatic.net/static/www/img/uit/2020/sp_shop.4e0461.png |
| url | http://blogimgs.naver.com/blog20/blog/layout_photo/viewer2/btn_right.gif |
| url | http://www.google.cz/ |
| description | Create a windows service | rule | Create_Service | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
| description | Hijack network configuration | rule | Hijack_Network | ||||||
| description | Record Audio | rule | Sniff_Audio | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerCheck__RemoteAPI | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | DebuggerException__ConsoleCtrl | ||||||
| description | (no description) | rule | DebuggerException__SetConsoleCtrl | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | (no description) | rule | Check_Dlls | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Anti-Sandbox checks for ThreatExpert | rule | antisb_threatExpert | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Affect hook table | rule | win_hook | ||||||
| description | File Downloader | rule | Network_Downloader | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Install itself for autorun at Windows startup | rule | Persistence | ||||||
| description | Communications over FTP | rule | Network_FTP | ||||||
| description | Run a KeyLogger | rule | KeyLogger | ||||||
| description | Communications over P2P network | rule | Network_P2P_Win | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Create a windows service | rule | Create_Service | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
| description | Hijack network configuration | rule | Hijack_Network | ||||||
| cmdline | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2616 CREDAT:145409 |
| host | 117.18.232.200 | |||