Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

2024-03-05...er.exe

windows7-x64

7

2024-03-05...er.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2024, 06:26 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-03-05_d34e6288c445d2ecd1b7c7b7dcb6bf92_magniber.exe

  • Size

    1.5MB

  • MD5

    d34e6288c445d2ecd1b7c7b7dcb6bf92

  • SHA1

    314d2a076b4c4e70dc399ea21a237c058cd8afde

  • SHA256

    4fd7f380594cfb52b2254be0d2129db39c4724301201ac15cd3cfb5586294966

  • SHA512

    fc323994a68b7a494bc2382107255a33db20230d70e19b08e988cd485b5b1e2b504e3480b2b6cc988714874b783ca48acf25c5af85ea709536f8c057983ebed0

  • SSDEEP

    24576:hjo/SmnVJYSINjaRSKqTDuZY7grQWP/fxA9ImEexQ:h0/VgSAKqTDuZ8k3X+8

Score
7/10
bootkitpersistence

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-05_d34e6288c445d2ecd1b7c7b7dcb6bf92_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-05_d34e6288c445d2ecd1b7c7b7dcb6bf92_magniber.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3988
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3988 -s 2392
      2⤵
      • Program crash
      PID:3124
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3988 -ip 3988
    1⤵
      PID:3700

    Network

    • flag-us
      DNS
      s.pcmgr.qq.com
      2024-03-05_d34e6288c445d2ecd1b7c7b7dcb6bf92_magniber.exe
      Remote address:
      8.8.8.8:53
      Request
      s.pcmgr.qq.com
      IN A
      Response
      s.pcmgr.qq.com
      IN CNAME
      ins-v2b2zvh8.ias.tencent-cloud.net
      ins-v2b2zvh8.ias.tencent-cloud.net
      IN A
      43.135.106.184
      ins-v2b2zvh8.ias.tencent-cloud.net
      IN A
      43.135.106.117
    • flag-hk
      GET
      http://s.pcmgr.qq.com/uninstall/
      2024-03-05_d34e6288c445d2ecd1b7c7b7dcb6bf92_magniber.exe
      Remote address:
      43.135.106.184:80
      Request
      GET /uninstall/ HTTP/1.1
      Accept: */*
      Accept-Language: en-US
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
      Host: s.pcmgr.qq.com
      Connection: Keep-Alive
      Response
      HTTP/1.1 302 Moved Temporarily
      Server: stgw
      Date: Tue, 05 Mar 2024 06:26:08 GMT
      Content-Type: text/html
      Content-Length: 137
      Connection: keep-alive
      Location: https://s.pcmgr.qq.com/uninstall/
    • flag-us
      DNS
      17.160.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      17.160.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      17.160.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      17.160.190.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      g.bing.com
      Remote address:
      8.8.8.8:53
      Request
      g.bing.com
      IN A
      Response
      g.bing.com
      IN CNAME
      g-bing-com.a-0001.a-msedge.net
      g-bing-com.a-0001.a-msedge.net
      IN CNAME
      dual-a-0001.a-msedge.net
      dual-a-0001.a-msedge.net
      IN A
      204.79.197.200
      dual-a-0001.a-msedge.net
      IN A
      13.107.21.200
    • flag-us
      DNS
      g.bing.com
      Remote address:
      8.8.8.8:53
      Request
      g.bing.com
      IN A
    • flag-us
      DNS
      241.154.82.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      241.154.82.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      184.106.135.43.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      184.106.135.43.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      183.142.211.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      183.142.211.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=fd8a55fd0fdb4acbb257a2b9cbf64306&localId=w:B4A3D36C-D183-1852-EB44-E34BD7DE44E3&deviceId=6755461009612214&anid=
      Remote address:
      204.79.197.200:443
      Request
      GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=fd8a55fd0fdb4acbb257a2b9cbf64306&localId=w:B4A3D36C-D183-1852-EB44-E34BD7DE44E3&deviceId=6755461009612214&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      set-cookie: MUID=171E62E84D8E6AC221C076D14CA96BD2; domain=.bing.com; expires=Sun, 30-Mar-2025 06:26:08 GMT; path=/; SameSite=None; Secure; Priority=High;
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 62B9C3DBEFBF4545B64FDA3C29CD404F Ref B: LON04EDGE0712 Ref C: 2024-03-05T06:26:08Z
      date: Tue, 05 Mar 2024 06:26:08 GMT
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=fd8a55fd0fdb4acbb257a2b9cbf64306&localId=w:B4A3D36C-D183-1852-EB44-E34BD7DE44E3&deviceId=6755461009612214&anid=
      Remote address:
      204.79.197.200:443
      Request
      GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=fd8a55fd0fdb4acbb257a2b9cbf64306&localId=w:B4A3D36C-D183-1852-EB44-E34BD7DE44E3&deviceId=6755461009612214&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      cookie: MUID=171E62E84D8E6AC221C076D14CA96BD2
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      set-cookie: MSPTC=v3WwXxY89vEyVKvfTEeWiIDokV3_5-VvceYbgIV-pVo; domain=.bing.com; expires=Sun, 30-Mar-2025 06:26:09 GMT; path=/; Partitioned; secure; SameSite=None
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 0ED96B9223264A6F9C4AE4875BD26B5D Ref B: LON04EDGE0712 Ref C: 2024-03-05T06:26:09Z
      date: Tue, 05 Mar 2024 06:26:09 GMT
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=fd8a55fd0fdb4acbb257a2b9cbf64306&localId=w:B4A3D36C-D183-1852-EB44-E34BD7DE44E3&deviceId=6755461009612214&anid=
      Remote address:
      204.79.197.200:443
      Request
      GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=fd8a55fd0fdb4acbb257a2b9cbf64306&localId=w:B4A3D36C-D183-1852-EB44-E34BD7DE44E3&deviceId=6755461009612214&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      cookie: MUID=171E62E84D8E6AC221C076D14CA96BD2; MSPTC=v3WwXxY89vEyVKvfTEeWiIDokV3_5-VvceYbgIV-pVo
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: BC2AF8B7C0A14B94A2C98BD90651D856 Ref B: LON04EDGE0712 Ref C: 2024-03-05T06:26:09Z
      date: Tue, 05 Mar 2024 06:26:09 GMT
    • flag-hk
      GET
      https://s.pcmgr.qq.com/uninstall/
      2024-03-05_d34e6288c445d2ecd1b7c7b7dcb6bf92_magniber.exe
      Remote address:
      43.135.106.184:443
      Request
      GET /uninstall/ HTTP/1.1
      Accept: */*
      Accept-Language: en-US
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
      Connection: Keep-Alive
      Host: s.pcmgr.qq.com
      Response
      HTTP/1.1 200 OK
      Date: Tue, 05 Mar 2024 06:26:12 GMT
      Content-Type: text/html
      Transfer-Encoding: chunked
      Connection: keep-alive
      Server: nginx
      Expires: Tue, 05 Mar 2024 06:36:12 GMT
      Cache-Control: max-age=600
      Content-Encoding: gzip
    • flag-hk
      GET
      https://s.pcmgr.qq.com/uninstall/css/style.css
      2024-03-05_d34e6288c445d2ecd1b7c7b7dcb6bf92_magniber.exe
      Remote address:
      43.135.106.184:443
      Request
      GET /uninstall/css/style.css HTTP/1.1
      Accept: */*
      Referer: https://s.pcmgr.qq.com/uninstall/
      Accept-Language: en-US
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
      Host: s.pcmgr.qq.com
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Tue, 05 Mar 2024 06:26:14 GMT
      Content-Type: text/css
      Transfer-Encoding: chunked
      Connection: keep-alive
      Server: nginx
      Last-Modified: Tue, 16 Jan 2024 06:58:25 GMT
      Expires: Wed, 05 Mar 2025 06:26:14 GMT
      Cache-Control: max-age=31536000
      Content-Encoding: gzip
    • flag-us
      DNS
      200.197.79.204.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      200.197.79.204.in-addr.arpa
      IN PTR
      Response
      200.197.79.204.in-addr.arpa
      IN PTR
      a-0001a-msedgenet
    • flag-us
      DNS
      180.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      180.178.17.96.in-addr.arpa
      IN PTR
      Response
      180.178.17.96.in-addr.arpa
      IN PTR
      a96-17-178-180deploystaticakamaitechnologiescom
    • flag-us
      DNS
      55.36.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      55.36.223.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      226.20.18.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      226.20.18.104.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      41.110.16.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      41.110.16.96.in-addr.arpa
      IN PTR
      Response
      41.110.16.96.in-addr.arpa
      IN PTR
      a96-16-110-41deploystaticakamaitechnologiescom
    • flag-us
      DNS
      9.228.82.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      9.228.82.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      pc1.gtimg.com
      2024-03-05_d34e6288c445d2ecd1b7c7b7dcb6bf92_magniber.exe
      Remote address:
      8.8.8.8:53
      Request
      pc1.gtimg.com
      IN A
      Response
      pc1.gtimg.com
      IN CNAME
      pc.tc.qq.com
      pc.tc.qq.com
      IN CNAME
      s.pc.qq.com.sched.legopic2-dk.tdnsv6.com
      s.pc.qq.com.sched.legopic2-dk.tdnsv6.com
      IN A
      61.243.13.94
      s.pc.qq.com.sched.legopic2-dk.tdnsv6.com
      IN A
      119.167.180.253
      s.pc.qq.com.sched.legopic2-dk.tdnsv6.com
      IN A
      119.167.180.150
      s.pc.qq.com.sched.legopic2-dk.tdnsv6.com
      IN A
      119.167.180.119
      s.pc.qq.com.sched.legopic2-dk.tdnsv6.com
      IN A
      113.207.69.71
      s.pc.qq.com.sched.legopic2-dk.tdnsv6.com
      IN A
      119.167.180.226
      s.pc.qq.com.sched.legopic2-dk.tdnsv6.com
      IN A
      221.204.209.188
      s.pc.qq.com.sched.legopic2-dk.tdnsv6.com
      IN A
      119.167.180.162
      s.pc.qq.com.sched.legopic2-dk.tdnsv6.com
      IN A
      119.167.180.160
      s.pc.qq.com.sched.legopic2-dk.tdnsv6.com
      IN A
      221.204.209.191
      s.pc.qq.com.sched.legopic2-dk.tdnsv6.com
      IN A
      119.188.155.60
      s.pc.qq.com.sched.legopic2-dk.tdnsv6.com
      IN A
      61.241.148.229
      s.pc.qq.com.sched.legopic2-dk.tdnsv6.com
      IN A
      119.167.180.241
      s.pc.qq.com.sched.legopic2-dk.tdnsv6.com
      IN A
      119.167.180.218
      s.pc.qq.com.sched.legopic2-dk.tdnsv6.com
      IN A
      61.243.13.108
    • flag-us
      DNS
      pc1.gtimg.com
      2024-03-05_d34e6288c445d2ecd1b7c7b7dcb6bf92_magniber.exe
      Remote address:
      8.8.8.8:53
      Request
      pc1.gtimg.com
      IN A
    • flag-us
      DNS
      pc1.gtimg.com
      2024-03-05_d34e6288c445d2ecd1b7c7b7dcb6bf92_magniber.exe
      Remote address:
      8.8.8.8:53
      Request
      pc1.gtimg.com
      IN A
    • flag-us
      DNS
      pc1.gtimg.com
      2024-03-05_d34e6288c445d2ecd1b7c7b7dcb6bf92_magniber.exe
      Remote address:
      8.8.8.8:53
      Request
      pc1.gtimg.com
      IN A
    • flag-us
      DNS
      157.123.68.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      157.123.68.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      157.123.68.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      157.123.68.40.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      171.39.242.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      171.39.242.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      18.134.221.88.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      18.134.221.88.in-addr.arpa
      IN PTR
      Response
      18.134.221.88.in-addr.arpa
      IN PTR
      a88-221-134-18deploystaticakamaitechnologiescom
    • flag-us
      DNS
      58.99.105.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.99.105.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      43.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.229.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      tse1.mm.bing.net
      Remote address:
      8.8.8.8:53
      Request
      tse1.mm.bing.net
      IN A
      Response
      tse1.mm.bing.net
      IN CNAME
      mm-mm.bing.net.trafficmanager.net
      mm-mm.bing.net.trafficmanager.net
      IN CNAME
      dual-a-0001.a-msedge.net
      dual-a-0001.a-msedge.net
      IN A
      204.79.197.200
      dual-a-0001.a-msedge.net
      IN A
      13.107.21.200
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239340418560_12H05GS2AXF1O4KMU&pid=21.2&w=1920&h=1080&c=4
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239340418560_12H05GS2AXF1O4KMU&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 322167
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 69B5002DAE2348D9871A639DCAE2DAE1 Ref B: LON04EDGE1120 Ref C: 2024-03-05T06:27:49Z
      date: Tue, 05 Mar 2024 06:27:49 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239339388253_1CSLK99Y5WENWUFPZ&pid=21.2&w=1080&h=1920&c=4
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239339388253_1CSLK99Y5WENWUFPZ&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 340273
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 147000F9CA1F45648C6EC77DF56AAA31 Ref B: LON04EDGE1120 Ref C: 2024-03-05T06:27:49Z
      date: Tue, 05 Mar 2024 06:27:49 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239340418559_1LXGGCLQWFST3067K&pid=21.2&w=1080&h=1920&c=4
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239340418559_1LXGGCLQWFST3067K&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 348923
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 636024A4F23F4F4AB9CB260BABB8A152 Ref B: LON04EDGE1120 Ref C: 2024-03-05T06:27:49Z
      date: Tue, 05 Mar 2024 06:27:49 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239339388252_1GYCUUPS8CMWY8UUC&pid=21.2&w=1920&h=1080&c=4
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239339388252_1GYCUUPS8CMWY8UUC&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 505472
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 5F4CA03002B34158B5D1DB2E21A7B9EA Ref B: LON04EDGE1120 Ref C: 2024-03-05T06:27:49Z
      date: Tue, 05 Mar 2024 06:27:49 GMT
    • flag-us
      DNS
      10.173.189.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      10.173.189.20.in-addr.arpa
      IN PTR
      Response
    • 43.135.106.184:80
      http://s.pcmgr.qq.com/uninstall/
      http
      2024-03-05_d34e6288c445d2ecd1b7c7b7dcb6bf92_magniber.exe
      936 B
       846 B
       7
      4

      HTTP Request

      GET http://s.pcmgr.qq.com/uninstall/

      HTTP Response

      302
    • 204.79.197.200:443
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=fd8a55fd0fdb4acbb257a2b9cbf64306&localId=w:B4A3D36C-D183-1852-EB44-E34BD7DE44E3&deviceId=6755461009612214&anid=
      tls, http2
      2.3kB
       9.6kB
       25
      20

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=fd8a55fd0fdb4acbb257a2b9cbf64306&localId=w:B4A3D36C-D183-1852-EB44-E34BD7DE44E3&deviceId=6755461009612214&anid=

      HTTP Response

      204

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=fd8a55fd0fdb4acbb257a2b9cbf64306&localId=w:B4A3D36C-D183-1852-EB44-E34BD7DE44E3&deviceId=6755461009612214&anid=

      HTTP Response

      204

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=fd8a55fd0fdb4acbb257a2b9cbf64306&localId=w:B4A3D36C-D183-1852-EB44-E34BD7DE44E3&deviceId=6755461009612214&anid=

      HTTP Response

      204
    • 43.135.106.184:443
      https://s.pcmgr.qq.com/uninstall/css/style.css
      tls, http
      2024-03-05_d34e6288c445d2ecd1b7c7b7dcb6bf92_magniber.exe
      2.7kB
       9.1kB
       20
      14

      HTTP Request

      GET https://s.pcmgr.qq.com/uninstall/

      HTTP Response

      200

      HTTP Request

      GET https://s.pcmgr.qq.com/uninstall/css/style.css

      HTTP Response

      200
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      1.1kB
       8.0kB
       14
      12
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      1.2kB
       8.1kB
       16
      14
    • 204.79.197.200:443
      https://tse1.mm.bing.net/th?id=OADD2.10239339388252_1GYCUUPS8CMWY8UUC&pid=21.2&w=1920&h=1080&c=4
      tls, http2
      55.2kB
       1.6MB
       1148
      1143

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239340418560_12H05GS2AXF1O4KMU&pid=21.2&w=1920&h=1080&c=4

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239339388253_1CSLK99Y5WENWUFPZ&pid=21.2&w=1080&h=1920&c=4

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239340418559_1LXGGCLQWFST3067K&pid=21.2&w=1080&h=1920&c=4

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239339388252_1GYCUUPS8CMWY8UUC&pid=21.2&w=1920&h=1080&c=4

      HTTP Response

      200

      HTTP Response

      200

      HTTP Response

      200

      HTTP Response

      200
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      1.1kB
       8.0kB
       14
      12
    • 8.8.8.8:53
      s.pcmgr.qq.com
      dns
      2024-03-05_d34e6288c445d2ecd1b7c7b7dcb6bf92_magniber.exe
      60 B
       140 B
       1
      1

      DNS Request

      s.pcmgr.qq.com

      DNS Response

      43.135.106.184
      43.135.106.117

    • 8.8.8.8:53
      17.160.190.20.in-addr.arpa
      dns
      144 B
       158 B
       2
      1

      DNS Request

      17.160.190.20.in-addr.arpa

      DNS Request

      17.160.190.20.in-addr.arpa

    • 8.8.8.8:53
      g.bing.com
      dns
      112 B
       158 B
       2
      1

      DNS Request

      g.bing.com

      DNS Request

      g.bing.com

      DNS Response

      204.79.197.200
      13.107.21.200

    • 8.8.8.8:53
      241.154.82.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      241.154.82.20.in-addr.arpa

    • 8.8.8.8:53
      184.106.135.43.in-addr.arpa
      dns
      73 B
       130 B
       1
      1

      DNS Request

      184.106.135.43.in-addr.arpa

    • 8.8.8.8:53
      183.142.211.20.in-addr.arpa
      dns
      73 B
       159 B
       1
      1

      DNS Request

      183.142.211.20.in-addr.arpa

    • 8.8.8.8:53
      200.197.79.204.in-addr.arpa
      dns
      73 B
       106 B
       1
      1

      DNS Request

      200.197.79.204.in-addr.arpa

    • 8.8.8.8:53
      180.178.17.96.in-addr.arpa
      dns
      72 B
       137 B
       1
      1

      DNS Request

      180.178.17.96.in-addr.arpa

    • 8.8.8.8:53
      55.36.223.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      55.36.223.20.in-addr.arpa

    • 8.8.8.8:53
      226.20.18.104.in-addr.arpa
      dns
      72 B
       134 B
       1
      1

      DNS Request

      226.20.18.104.in-addr.arpa

    • 8.8.8.8:53
      41.110.16.96.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      41.110.16.96.in-addr.arpa

    • 8.8.8.8:53
      9.228.82.20.in-addr.arpa
      dns
      70 B
       156 B
       1
      1

      DNS Request

      9.228.82.20.in-addr.arpa

    • 8.8.8.8:53
      pc1.gtimg.com
      dns
      2024-03-05_d34e6288c445d2ecd1b7c7b7dcb6bf92_magniber.exe
      236 B
       373 B
       4
      1

      DNS Request

      pc1.gtimg.com

      DNS Request

      pc1.gtimg.com

      DNS Request

      pc1.gtimg.com

      DNS Request

      pc1.gtimg.com

      DNS Response

      61.243.13.94
      119.167.180.253
      119.167.180.150
      119.167.180.119
      113.207.69.71
      119.167.180.226
      221.204.209.188
      119.167.180.162
      119.167.180.160
      221.204.209.191
      119.188.155.60
      61.241.148.229
      119.167.180.241
      119.167.180.218
      61.243.13.108

    • 8.8.8.8:53
      157.123.68.40.in-addr.arpa
      dns
      144 B
       146 B
       2
      1

      DNS Request

      157.123.68.40.in-addr.arpa

      DNS Request

      157.123.68.40.in-addr.arpa

    • 8.8.8.8:53
      171.39.242.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      171.39.242.20.in-addr.arpa

    • 8.8.8.8:53
      18.134.221.88.in-addr.arpa
      dns
      72 B
       137 B
       1
      1

      DNS Request

      18.134.221.88.in-addr.arpa

    • 8.8.8.8:53
      58.99.105.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      58.99.105.20.in-addr.arpa

    • 8.8.8.8:53
      43.229.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      43.229.111.52.in-addr.arpa

    • 8.8.8.8:53
      tse1.mm.bing.net
      dns
      62 B
       173 B
       1
      1

      DNS Request

      tse1.mm.bing.net

      DNS Response

      204.79.197.200
      13.107.21.200

    • 8.8.8.8:53
      10.173.189.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      10.173.189.20.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\UNIBAFD.tmp\dr.dll
      Filesize

      346KB

      MD5

      47e5db9c8990f133d57c564c20668d38

      SHA1

      b8d90e8922c71935c61ecaae9a482fba6c3439ba

      SHA256

      5d14c76dbc223385f34e60391ca91475078c1fe35822bf91f825fc8196d95fcd

      SHA512

      000608913349ce84ef8eda5f68d03ef74fd57f6a16d74cb5b0945621f281b2396535f42daac33ab7bf94317b783caec9c32edfbaffa4da56c97dbfe9ea084488

      Download Submit

    • memory/3988-14-0x0000000004450000-0x0000000004451000-memory.dmp

      Filesize

      4KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.