NetWork | ZeroBOX

Network Analysis

IP Address Status Action
164.124.101.2 Active Moloch
217.154.55.185 Active Moloch
23.186.113.60 Active Moloch
Name Response Post-Analysis Lookup
paste.ee 23.186.113.60
GET 200 http://217.154.55.185/450/newwelcomedrinkforentireteammemebers.hta?&border=tender
REQUEST
RESPONSE

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49166 -> 23.186.113.60:443 2034978 ET POLICY Pastebin-style Service (paste .ee) in TLS SNI Potential Corporate Privacy Violation
TCP 192.168.56.101:49165 -> 23.186.113.60:443 2034978 ET POLICY Pastebin-style Service (paste .ee) in TLS SNI Potential Corporate Privacy Violation
TCP 192.168.56.101:49166 -> 23.186.113.60:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49165 -> 23.186.113.60:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.101:49166 -> 23.186.113.60:443 2034978 ET POLICY Pastebin-style Service (paste .ee) in TLS SNI Potential Corporate Privacy Violation
TCP 192.168.56.101:49165 -> 23.186.113.60:443 2034978 ET POLICY Pastebin-style Service (paste .ee) in TLS SNI Potential Corporate Privacy Violation
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2054041 ET INFO Pastebin-like Service Domain in DNS Lookup (paste .ee) Misc activity
TCP 23.186.113.60:443 -> 192.168.56.101:49168 2029340 ET INFO TLS Handshake Failure Potentially Bad Traffic
TCP 192.168.56.101:49163 -> 217.154.55.185:80 2024449 ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl Attempted User Privilege Gain
TCP 192.168.56.101:49166 -> 23.186.113.60:443 2034978 ET POLICY Pastebin-style Service (paste .ee) in TLS SNI Potential Corporate Privacy Violation
TCP 192.168.56.101:49165 -> 23.186.113.60:443 2034978 ET POLICY Pastebin-style Service (paste .ee) in TLS SNI Potential Corporate Privacy Violation
TCP 217.154.55.185:80 -> 192.168.56.101:49163 2024197 ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) A Network Trojan was detected
TCP 217.154.55.185:80 -> 192.168.56.101:49163 2012263 ET WEB_CLIENT Hex Obfuscation of Script Tag % Encoding Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts