hxxp://0redire[.]com/jr[.]php?gz=Ci7%2BNEZ%2FmN%2B8As82zoRndX49flJCSDBId0xldWdpU3c4cXJENm9hekFwVURlVUJodjc1Sk1iRTg2UjFFbSszYjgzQ0VEYWNSLzhHYlFwWThNTXNIQlNTU0oxamZia0w4anBQVXRBMDdYSnRuTmdYUWQ2RGlZeW9EcjBJS0xGRU5uVExTQlY3VGpmSEsrOGNyYTc3MnFleDZpU3FrNW5xUVAwTDdkV05obXlxckJnUVp6Wm8yQzlFRW5OUXF2VEZsa0o3MXdLQm1VcXRtbERxdmJBVTQ1eEszOUhWblZ5Ky9JRUdqejY2elU4Yk1pN0ZTbFNUeitMV0ZNeEhyUXEyK2lCNkFCaDJDNG91cjNFSXFiMi9sQ2ZPTllWOGhlaW9XSFE1aXUwV3BQaEh6VDYwSE5kZ1FZRGxrbTdIMlBGZ0NFdnBpQXFDZ1p3VGpxdkZXaTJtNk5Fb0Ivbkd1ZWtNeWVLR2l0L0xMeVZEVUZCRDduUXIvSDZSd2hjSDNtenMwY1liTndncEJBVWR0dVBSK3pwYUdOL0JsVjluanhveCtxOU9TekFqUGYweTRiUW1PckhSdXY3NHc0VmxweFFKNktGcDhBSkRYdkoxdUdLY3V1dGhWelliVHZkeEVrdFNXSXBRNHhkK2RDZFBKNTFGczFqRmxTRlF1OE43NXNjRlFvWFY2eU5zNVhhdWlFdWFybTZjRmVEOTZkOGhsWS8yWnNabW5RMysyMHh3bTFaTEo0dUcyTklaTW9lUHhpMWNVMzFwZDd4RVB3ejJoaXl5Zy8yZGk1aVNRZlJxU3VDdkZ5OE00Y0U0Qmg4KzhRYnArVE43ZDBZMW5kVWFibXdCRTl0Y2NmMkdZM2kzYWVSZzcrWEJOMEtPQ0JzekFmdUd6WDZsZ3RUa0VCaFdYMEpnVWpSYk1sQTE0QmxGZ3F4d25zWG5YWGFFUXBzaGE0NzVXTG9vZWxoK1NGTVUvd1dPenYyNks2cXF3MkkzVmhHbHdqWVVLYnh1bW9UVXN5OD0%3D&vs=1920[:]969&ds=1920[:]1080&sl=0[:]0&os=f&nos=f&swfV=0[.]0[.]0&if=f&sc=f&gpu=Google%20Inc[.]%20(Intel)%20-%20ANGLE%20(Intel,%20Intel(R)%20UHD%20Graphics%20630%20Direct3D11%20vs_5_0%20ps_5_0,%20D3D11)&anura_res= [hxxps://can01[.]safelinks[.]protection[.]outlook[.]com/?url=http%3A%2F%2F0redire[.]com%2Fjr[.]php%3Fgz%3DCi7%252BNEZ%252FmN%252B8As82zoRndX49flJCSDBId0xldWdpU3c4cXJENm9hekFwVURlVUJodjc1Sk1iRTg2UjFFbSszYjgzQ0VEYWNSLzhHYlFwWThNTXNIQlNTU0oxamZia0w4anBQVXRBMDdYSnRuTmdYUWQ2RGlZeW9EcjBJS0xGRU5uVExTQlY3VGpmSEsrOGNyYTc3MnFleDZpU3FrNW5xUVAwTDdkV05obXlxckJnUVp6Wm8yQzlFRW5OUXF2VEZsa0o3MXdLQm1VcXRtbERxdmJBVTQ1eEszOUhWblZ5Ky9JRUdqejY2elU4Yk1pN0ZTbFNUeitMV0ZNeEhyUXEyK2lCNkFCaDJDNG91cjNFSXFiMi9sQ2ZPTllWOGhlaW9XSFE1aXUwV3BQaEh6VDYwSE5kZ1FZRGxrbTdIMlBGZ0NFdnBpQXFDZ1p3VGpxdkZXaTJtNk5Fb0Ivbkd1ZWtNeWVLR2l0L0xMeVZEVUZCRDduUXIvSDZSd2hjSDNtenMwY1liTndncEJBVWR0dVBSK3pwYUdOL0JsVjluanhveCtxOU9TekFqUGYweTRiUW1PckhSdXY3NHc0VmxweFFKNktGcDhBSkRYdkoxdUdLY3V1dGhWelliVHZkeEVrdFNXSXBRNHhkK2RDZFBKNTFGczFqRmxTRlF1OE43NXNjRlFvWFY2eU5zNVhhdWlFdWFybTZjRmVEOTZkOGhsWS8yWnNabW5RMysyMHh3bTFaTEo0dUcyTklaTW9lUHhpMWNVMzFwZDd4RVB3ejJoaXl5Zy8yZGk1aVNRZlJxU3VDdkZ5OE00Y0U0Qmg4KzhRYnArVE43ZDBZMW5kVWFibXdCRTl0Y2NmMkdZM2kzYWVSZzcrWEJOMEtPQ0JzekFmdUd6WDZsZ3RUa0VCaFdYMEpnVWpSYk1sQTE0QmxGZ3F4d25zWG5YWGFFUXBzaGE0NzVXTG9vZWxoK1NGTVUvd1dPenYyNks2cXF3MkkzVmhHbHdqWVVLYnh1bW9UVXN5OD0%253D%26vs%3D1920%3A969%26ds%3D1920%3A1080%26sl%3D0%3A0%26os%3Df%26nos%3Df%26swfV%3D0[.]0[.]0%26if%3Df%26sc%3Df%26gpu%3DGoogle%2520Inc[.]%2520(Intel)%2520-%2520ANGLE%2520(Intel%2C%2520Intel(R)%2520UHD%2520Graphics%2520630%2520Direct3D11%2520vs_5_0%2520ps_5_0%2C%2520D3D11)%26anura_res%3D&data=05%7C01%7Cservicenow%40toh[.]ca%7C01820a670c7643410ff308db24b364da%7C859b41b6130f4d13a6931ffec4e7cb5a%7C0%7C0%7C638144125121834791%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=qJAOuRJrzJwYYsGDpIqKn6AknYvjJKqkUl1z5UegQMU%3D&reserved=0]

Sharing

Behavioral task

behavioral1

Sample

http://0redire.com/jr.php?gz=Ci7%2BNEZ%2FmN%2B8As82zoRndX49flJCSDBId0xldWdpU3c4cXJENm9hekFwVURlVUJodjc1Sk1iRTg2UjFFbSszYjgzQ0VEYWNSLzhHYlFwWThNTXNIQlNTU0oxamZia0w4anBQVXRBMDdYSnRuTmdYUWQ2RGlZeW9EcjBJS0xGRU5uVExTQlY3VGpmSEsrOGNyYTc3MnFleDZpU3FrNW5xUVAwTDdkV05obXlxckJnUVp6Wm8yQzlFRW5OUXF2VEZsa0o3MXdLQm1VcXRtbERxdmJBVTQ1eEszOUhWblZ5Ky9JRUdqejY2elU4Yk1pN0ZTbFNUeitMV0ZNeEhyUXEyK2lCNkFCaDJDNG91cjNFSXFiMi9sQ2ZPTllWOGhlaW9XSFE1aXUwV3BQaEh6VDYwSE5kZ1FZRGxrbTdIMlBGZ0NFdnBpQXFDZ1p3VGpxdkZXaTJtNk5Fb0Ivbkd1ZWtNeWVLR2l0L0xMeVZEVUZCRDduUXIvSDZSd2hjSDNtenMwY1liTndncEJBVWR0dVBSK3pwYUdOL0JsVjluanhveCtxOU9TekFqUGYweTRiUW1PckhSdXY3NHc0VmxweFFKNktGcDhBSkRYdkoxdUdLY3V1dGhWelliVHZkeEVrdFNXSXBRNHhkK2RDZFBKNTFGczFqRmxTRlF1OE43NXNjRlFvWFY2eU5zNVhhdWlFdWFybTZjRmVEOTZkOGhsWS8yWnNabW5RMysyMHh3bTFaTEo0dUcyTklaTW9lUHhpMWNVMzFwZDd4RVB3ejJoaXl5Zy8yZGk1aVNRZlJxU3VDdkZ5OE00Y0U0Qmg4KzhRYnArVE43ZDBZMW5kVWFibXdCRTl0Y2NmMkdZM2kzYWVSZzcrWEJOMEtPQ0JzekFmdUd6WDZsZ3RUa0VCaFdYMEpnVWpSYk1sQTE0QmxGZ3F4d25zWG5YWGFFUXBzaGE0NzVXTG9vZWxoK1NGTVUvd1dPenYyNks2cXF3MkkzVmhHbHdqWVVLYnh1bW9UVXN5OD0%3D&vs=1920:969&ds=1920:1080&sl=0:0&os=f&nos=f&swfV=0.0.0&if=f&sc=f&gpu=Google%20Inc.%20(Intel)%20-%20ANGLE%20(Intel,%20Intel(R)%20UHD%20Graphics%20630%20Direct3D11%20vs_5_0%20ps_5_0,%20D3D11)&anura_res= [https://can01.safelinks.protection.outlook.com/?url=http%3A%2F%2F0redire.com%2Fjr.php%3Fgz%3DCi7%252BNEZ%252FmN%252B8As82zoRndX49flJCSDBId0xldWdpU3c4cXJENm9hekFwVURlVUJodjc1Sk1iRTg2UjFFbSszYjgzQ0VEYWNSLzhHYlFwWThNTXNIQlNTU0oxamZia0w4anBQVXRBMDdYSnRuTmdYUWQ2RGlZeW9EcjBJS0xGRU5uVExTQlY3VGpmSEsrOGNyYTc3MnFleDZpU3FrNW5xUVAwTDdkV05obXlxckJnUVp6Wm8yQzlFRW5OUXF2VEZsa0o3MXdLQm1VcXRtbERxdmJBVTQ1eEszOUhWblZ5Ky9JRUdqejY2elU4Yk1pN0ZTbFNUeitMV0ZNeEhyUXEyK2lCNkFCaDJDNG91cjNFSXFiMi9sQ2ZPTllWOGhlaW9XSFE1aXUwV3BQaEh6VDYwSE5kZ1FZRGxrbTdIMlBGZ0NFdnBpQXFDZ1p3VGpxdkZXaTJtNk5Fb0Ivbkd1ZWtNeWVLR2l0L0xMeVZEVUZCRDduUXIvSDZSd2hjSDNtenMwY1liTndncEJBVWR0dVBSK3pwYUdOL0JsVjluanhveCtxOU9TekFqUGYweTRiUW1PckhSdXY3NHc0VmxweFFKNktGcDhBSkRYdkoxdUdLY3V1dGhWelliVHZkeEVrdFNXSXBRNHhkK2RDZFBKNTFGczFqRmxTRlF1OE43NXNjRlFvWFY2eU5zNVhhdWlFdWFybTZjRmVEOTZkOGhsWS8yWnNabW5RMysyMHh3bTFaTEo0dUcyTklaTW9lUHhpMWNVMzFwZDd4RVB3ejJoaXl5Zy8yZGk1aVNRZlJxU3VDdkZ5OE00Y0U0Qmg4KzhRYnArVE43ZDBZMW5kVWFibXdCRTl0Y2NmMkdZM2kzYWVSZzcrWEJOMEtPQ0JzekFmdUd6WDZsZ3RUa0VCaFdYMEpnVWpSYk1sQTE0QmxGZ3F4d25zWG5YWGFFUXBzaGE0NzVXTG9vZWxoK1NGTVUvd1dPenYyNks2cXF3MkkzVmhHbHdqWVVLYnh1bW9UVXN5OD0%253D%26vs%3D1920%3A969%26ds%3D1920%3A1080%26sl%3D0%3A0%26os%3Df%26nos%3Df%26swfV%3D0.0.0%26if%3Df%26sc%3Df%26gpu%3DGoogle%2520Inc.%2520(Intel)%2520-%2520ANGLE%2520(Intel%2C%2520Intel(R)%2520UHD%2520Graphics%2520630%2520Direct3D11%2520vs_5_0%2520ps_5_0%2C%2520D3D11)%26anura_res%3D&data=05%7C01%7Cservicenow%40toh.ca%7C01820a670c7643410ff308db24b364da%7C859b41b6130f4d13a6931ffec4e7cb5a%7C0%7C0%7C638144125121834791%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=qJAOuRJrzJwYYsGDpIqKn6AknYvjJKqkUl1z5UegQMU%3D&reserved=0]

Resource

win10v2004-20230220-en

persistence

windows10-2004-x64

9 signatures

300 seconds

General

Target

http://0redire.com/jr.php?gz=Ci7%2BNEZ%2FmN%2B8As82zoRndX49flJCSDBId0xldWdpU3c4cXJENm9hekFwVURlVUJodjc1Sk1iRTg2UjFFbSszYjgzQ0VEYWNSLzhHYlFwWThNTXNIQlNTU0oxamZia0w4anBQVXRBMDdYSnRuTmdYUWQ2RGlZeW9EcjBJS0xGRU5uVExTQlY3VGpmSEsrOGNyYTc3MnFleDZpU3FrNW5xUVAwTDdkV05obXlxckJnUVp6Wm8yQzlFRW5OUXF2VEZsa0o3MXdLQm1VcXRtbERxdmJBVTQ1eEszOUhWblZ5Ky9JRUdqejY2elU4Yk1pN0ZTbFNUeitMV0ZNeEhyUXEyK2lCNkFCaDJDNG91cjNFSXFiMi9sQ2ZPTllWOGhlaW9XSFE1aXUwV3BQaEh6VDYwSE5kZ1FZRGxrbTdIMlBGZ0NFdnBpQXFDZ1p3VGpxdkZXaTJtNk5Fb0Ivbkd1ZWtNeWVLR2l0L0xMeVZEVUZCRDduUXIvSDZSd2hjSDNtenMwY1liTndncEJBVWR0dVBSK3pwYUdOL0JsVjluanhveCtxOU9TekFqUGYweTRiUW1PckhSdXY3NHc0VmxweFFKNktGcDhBSkRYdkoxdUdLY3V1dGhWelliVHZkeEVrdFNXSXBRNHhkK2RDZFBKNTFGczFqRmxTRlF1OE43NXNjRlFvWFY2eU5zNVhhdWlFdWFybTZjRmVEOTZkOGhsWS8yWnNabW5RMysyMHh3bTFaTEo0dUcyTklaTW9lUHhpMWNVMzFwZDd4RVB3ejJoaXl5Zy8yZGk1aVNRZlJxU3VDdkZ5OE00Y0U0Qmg4KzhRYnArVE43ZDBZMW5kVWFibXdCRTl0Y2NmMkdZM2kzYWVSZzcrWEJOMEtPQ0JzekFmdUd6WDZsZ3RUa0VCaFdYMEpnVWpSYk1sQTE0QmxGZ3F4d25zWG5YWGFFUXBzaGE0NzVXTG9vZWxoK1NGTVUvd1dPenYyNks2cXF3MkkzVmhHbHdqWVVLYnh1bW9UVXN5OD0%3D&vs=1920:969&ds=1920:1080&sl=0:0&os=f&nos=f&swfV=0.0.0&if=f&sc=f&gpu=Google%20Inc.%20(Intel)%20-%20ANGLE%20(Intel,%20Intel(R)%20UHD%20Graphics%20630%20Direct3D11%20vs_5_0%20ps_5_0,%20D3D11)&anura_res= [https://can01.safelinks.protection.outlook.com/?url=http%3A%2F%2F0redire.com%2Fjr.php%3Fgz%3DCi7%252BNEZ%252FmN%252B8As82zoRndX49flJCSDBId0xldWdpU3c4cXJENm9hekFwVURlVUJodjc1Sk1iRTg2UjFFbSszYjgzQ0VEYWNSLzhHYlFwWThNTXNIQlNTU0oxamZia0w4anBQVXRBMDdYSnRuTmdYUWQ2RGlZeW9EcjBJS0xGRU5uVExTQlY3VGpmSEsrOGNyYTc3MnFleDZpU3FrNW5xUVAwTDdkV05obXlxckJnUVp6Wm8yQzlFRW5OUXF2VEZsa0o3MXdLQm1VcXRtbERxdmJBVTQ1eEszOUhWblZ5Ky9JRUdqejY2elU4Yk1pN0ZTbFNUeitMV0ZNeEhyUXEyK2lCNkFCaDJDNG91cjNFSXFiMi9sQ2ZPTllWOGhlaW9XSFE1aXUwV3BQaEh6VDYwSE5kZ1FZRGxrbTdIMlBGZ0NFdnBpQXFDZ1p3VGpxdkZXaTJtNk5Fb0Ivbkd1ZWtNeWVLR2l0L0xMeVZEVUZCRDduUXIvSDZSd2hjSDNtenMwY1liTndncEJBVWR0dVBSK3pwYUdOL0JsVjluanhveCtxOU9TekFqUGYweTRiUW1PckhSdXY3NHc0VmxweFFKNktGcDhBSkRYdkoxdUdLY3V1dGhWelliVHZkeEVrdFNXSXBRNHhkK2RDZFBKNTFGczFqRmxTRlF1OE43NXNjRlFvWFY2eU5zNVhhdWlFdWFybTZjRmVEOTZkOGhsWS8yWnNabW5RMysyMHh3bTFaTEo0dUcyTklaTW9lUHhpMWNVMzFwZDd4RVB3ejJoaXl5Zy8yZGk1aVNRZlJxU3VDdkZ5OE00Y0U0Qmg4KzhRYnArVE43ZDBZMW5kVWFibXdCRTl0Y2NmMkdZM2kzYWVSZzcrWEJOMEtPQ0JzekFmdUd6WDZsZ3RUa0VCaFdYMEpnVWpSYk1sQTE0QmxGZ3F4d25zWG5YWGFFUXBzaGE0NzVXTG9vZWxoK1NGTVUvd1dPenYyNks2cXF3MkkzVmhHbHdqWVVLYnh1bW9UVXN5OD0%253D%26vs%3D1920%3A969%26ds%3D1920%3A1080%26sl%3D0%3A0%26os%3Df%26nos%3Df%26swfV%3D0.0.0%26if%3Df%26sc%3Df%26gpu%3DGoogle%2520Inc.%2520(Intel)%2520-%2520ANGLE%2520(Intel%2C%2520Intel(R)%2520UHD%2520Graphics%2520630%2520Direct3D11%2520vs_5_0%2520ps_5_0%2C%2520D3D11)%26anura_res%3D&data=05%7C01%7Cservicenow%40toh.ca%7C01820a670c7643410ff308db24b364da%7C859b41b6130f4d13a6931ffec4e7cb5a%7C0%7C0%7C638144125121834791%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=qJAOuRJrzJwYYsGDpIqKn6AknYvjJKqkUl1z5UegQMU%3D&reserved=0]

Sharing

General

Malware Config

Signatures

Files