Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

2024-05-11...os.exe

windows7-x64

10

2024-05-11...os.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/05/2024, 21:31 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-11_ceb805e2e76cdedfc302a90689d29036_phobos.exe

  • Size

    56KB

  • MD5

    ceb805e2e76cdedfc302a90689d29036

  • SHA1

    a0fa891e036e932a7294042166564d56ec4310e4

  • SHA256

    5e9902d0d003db7905864ca8a1cf4616d144f56c066156ff700a86d9fa77a09f

  • SHA512

    2abffe6481017829e5a8702a1555eb8385dfc637fa97f8eda4473afb7bda29ea9f598fbe02db079cf1f97509991f8d467d667915c55f7617cabc1827833e4885

  • SSDEEP

    1536:+NeRBl5PT/rx1mzwRMSTdLpJluznEFHWa0IQ:+QRrmzwR5JszEFHoIQ

Score
10/10
phobosdefense_evasionevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\info.hta

Ransom Note
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'> <html> <head> <meta charset='windows-1251'> <title>encrypted</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language='JScript'> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type='text/css'> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background: #EDEDED; } img { display:inline-block; } .bold { font-weight: bold; } .mark { background: #D0D0E8; padding: 2px 5px; } .header { text-align: center; font-size: 30px; line-height: 50px; font-weight: bold; margin-bottom:20px; } .info { background: #D0D0E8; border-left: 10px solid #00008B; } .alert { background: #FFE4E4; border-left: 10px solid #FF0000; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } .footer { position:fixed; bottom:0; right:0; text-align: right; } </style> </head> <body> <div class='header'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='> <div>ATTENTION!</div> <div>ALL YOUR DATA ARE PROTECTED WITH RSA ALGORITHM</div> </div> <div class='bold'>Your security system was vulnerable, so all of your files are encrypted.</div> <div class='bold'>If you want to restore them, contact us by email: <span class='mark'>restorefiles69@cock.li</span></div> <div class='bold'>in the header of the letter indicate your encrypted ID <span class='mark'>788BD37A-2930</span></div> <div class='bold'>If you do not receive a response within 24 hours, please contact us by Telegram.org account: <span class='mark'><a href='https://t.me/Resp0nse'>@Resp0nse</a></span></div> <div class='note alert'> <div class='title'>BE CAREFUL AND DO NOT DAMAGE YOUR DATA:</div> <ul> <li>Do not rename encrypted files.</li> <li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li> <li>Do not trust anyone! Only we have keys to your files! Without this keys restore your data is impossible</li> </ul> </div> <div class='note info'> <div class='title'>WE GUARANTEE A FREE DECODE AS A PROOF OF OUR POSSIBILITIES:</div> <ul>You can send us 2 files for free decryption. Size of file must be less than 1 Mb (non archived). We don`t decrypt for test DATABASE, XLS and other important files.</ul> </div> <div class='note info'> <div class='title'>DO NOT ATTEMPT TO DECODE YOUR DATA YOURSELF, YOU ONLY DAMAGE THEM AND THEN YOU LOSE THEM FOREVER.</div> <div class='title'>AFTER DECRYPTION YOUR SYSTEM WILL RETURN TO A FULLY NORMALLY AND OPERATIONAL CONDITION!</div> </div> </body> </html>
Emails

class='mark'>restorefiles69@cock.li</span></div>

URLs

http://www.w3.org/TR/html4/strict.dtd'>

Signatures

  • Phobos

    Phobos ransomware appeared at the beginning of 2019.

    ransomwarephobos
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
    ransomwareevasion
  • Renames multiple (516) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 2 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-11_ceb805e2e76cdedfc302a90689d29036_phobos.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-11_ceb805e2e76cdedfc302a90689d29036_phobos.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2656
    • C:\Users\Admin\AppData\Local\Temp\2024-05-11_ceb805e2e76cdedfc302a90689d29036_phobos.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-05-11_ceb805e2e76cdedfc302a90689d29036_phobos.exe"
      2⤵
        PID:2200
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3196
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:2392
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:5092
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:3968
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          3⤵
          • Modifies boot configuration data using bcdedit
          PID:4596
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          3⤵
          • Deletes backup catalog
          PID:1216
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2788
        • C:\Windows\system32\netsh.exe
          netsh advfirewall set currentprofile state off
          3⤵
          • Modifies Windows Firewall
          PID:1496
        • C:\Windows\system32\netsh.exe
          netsh firewall set opmode mode=disable
          3⤵
          • Modifies Windows Firewall
          PID:4304
      • C:\Windows\SysWOW64\mshta.exe
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
        2⤵
          PID:2628
        • C:\Windows\SysWOW64\mshta.exe
          "C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
          2⤵
            PID:3660
          • C:\Windows\SysWOW64\mshta.exe
            "C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
            2⤵
              PID:3400
            • C:\Windows\SysWOW64\mshta.exe
              "C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
              2⤵
                PID:3588
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3304
                • C:\Windows\system32\vssadmin.exe
                  vssadmin delete shadows /all /quiet
                  3⤵
                  • Interacts with shadow copies
                  PID:3408
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic shadowcopy delete
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4440
                • C:\Windows\system32\bcdedit.exe
                  bcdedit /set {default} bootstatuspolicy ignoreallfailures
                  3⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2092
                • C:\Windows\system32\bcdedit.exe
                  bcdedit /set {default} recoveryenabled no
                  3⤵
                  • Modifies boot configuration data using bcdedit
                  PID:3720
                • C:\Windows\system32\wbadmin.exe
                  wbadmin delete catalog -quiet
                  3⤵
                  • Deletes backup catalog
                  PID:4432
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4952
            • C:\Windows\system32\wbengine.exe
              "C:\Windows\system32\wbengine.exe"
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4100
            • C:\Windows\System32\vdsldr.exe
              C:\Windows\System32\vdsldr.exe -Embedding
              1⤵
                PID:4388
              • C:\Windows\System32\vds.exe
                C:\Windows\System32\vds.exe
                1⤵
                • Checks SCSI registry key(s)
                PID:4640

              Network

              • flag-us
                DNS
                196.249.167.52.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                196.249.167.52.in-addr.arpa
                IN PTR
                Response
              • flag-us
                DNS
                g.bing.com
                Remote address:
                8.8.8.8:53
                Request
                g.bing.com
                IN A
                Response
                g.bing.com
                IN CNAME
                g-bing-com.dual-a-0034.a-msedge.net
                g-bing-com.dual-a-0034.a-msedge.net
                IN CNAME
                dual-a-0034.a-msedge.net
                dual-a-0034.a-msedge.net
                IN A
                204.79.197.237
                dual-a-0034.a-msedge.net
                IN A
                13.107.21.237
              • flag-us
                GET
                https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De82oQmh8djyLctL4Kik2wPgjVUCUyQAwn12C7PxN4A2EvPhAcxiWLkMCCfUjc4E_E4URAuEvsHocoKIEepHQKavWke_Qa44nCs4iFNsBg9AMKxKCZ6x-sJuQ1efXANolCXJBhzUVzkMh9LtVtn9szoKXQJxrNQIUj7ZuCvA2NRjGJq2y2Y%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D590e003290821430f91266193fd698fb&TIME=20240426T134314Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:465F5D2A-B062-9966-D2D4-950980DD8E0E&deviceId=6966564702272893&muid=465F5D2AB0629966D2D4950980DD8E0E
                Remote address:
                204.79.197.237:443
                Request
                GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De82oQmh8djyLctL4Kik2wPgjVUCUyQAwn12C7PxN4A2EvPhAcxiWLkMCCfUjc4E_E4URAuEvsHocoKIEepHQKavWke_Qa44nCs4iFNsBg9AMKxKCZ6x-sJuQ1efXANolCXJBhzUVzkMh9LtVtn9szoKXQJxrNQIUj7ZuCvA2NRjGJq2y2Y%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D590e003290821430f91266193fd698fb&TIME=20240426T134314Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:465F5D2A-B062-9966-D2D4-950980DD8E0E&deviceId=6966564702272893&muid=465F5D2AB0629966D2D4950980DD8E0E HTTP/2.0
                host: g.bing.com
                accept-encoding: gzip, deflate
                user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                Response
                HTTP/2.0 204
                cache-control: no-cache, must-revalidate
                pragma: no-cache
                expires: Fri, 01 Jan 1990 00:00:00 GMT
                set-cookie: MUID=276F8B7CCB6465FD3D009F00CA8464D4; domain=.bing.com; expires=Thu, 05-Jun-2025 21:31:10 GMT; path=/; SameSite=None; Secure; Priority=High;
                strict-transport-security: max-age=31536000; includeSubDomains; preload
                access-control-allow-origin: *
                x-cache: CONFIG_NOCACHE
                accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                x-msedge-ref: Ref A: 023E7940789E400FAA2AB68836A94EDA Ref B: LON04EDGE1007 Ref C: 2024-05-11T21:31:10Z
                date: Sat, 11 May 2024 21:31:09 GMT
              • flag-us
                GET
                https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De82oQmh8djyLctL4Kik2wPgjVUCUyQAwn12C7PxN4A2EvPhAcxiWLkMCCfUjc4E_E4URAuEvsHocoKIEepHQKavWke_Qa44nCs4iFNsBg9AMKxKCZ6x-sJuQ1efXANolCXJBhzUVzkMh9LtVtn9szoKXQJxrNQIUj7ZuCvA2NRjGJq2y2Y%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D590e003290821430f91266193fd698fb&TIME=20240426T134314Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:465F5D2A-B062-9966-D2D4-950980DD8E0E&deviceId=6966564702272893&muid=465F5D2AB0629966D2D4950980DD8E0E
                Remote address:
                204.79.197.237:443
                Request
                GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De82oQmh8djyLctL4Kik2wPgjVUCUyQAwn12C7PxN4A2EvPhAcxiWLkMCCfUjc4E_E4URAuEvsHocoKIEepHQKavWke_Qa44nCs4iFNsBg9AMKxKCZ6x-sJuQ1efXANolCXJBhzUVzkMh9LtVtn9szoKXQJxrNQIUj7ZuCvA2NRjGJq2y2Y%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D590e003290821430f91266193fd698fb&TIME=20240426T134314Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:465F5D2A-B062-9966-D2D4-950980DD8E0E&deviceId=6966564702272893&muid=465F5D2AB0629966D2D4950980DD8E0E HTTP/2.0
                host: g.bing.com
                accept-encoding: gzip, deflate
                user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                cookie: MUID=276F8B7CCB6465FD3D009F00CA8464D4; _EDGE_S=SID=181988E44FFC6BAA34259C984E906AC9
                Response
                HTTP/2.0 204
                cache-control: no-cache, must-revalidate
                pragma: no-cache
                expires: Fri, 01 Jan 1990 00:00:00 GMT
                set-cookie: MSPTC=59GJ8xr3_moqjMDEhhnjw-V5PyAhGTIOJG75tbf0q-c; domain=.bing.com; expires=Thu, 05-Jun-2025 21:31:11 GMT; path=/; Partitioned; secure; SameSite=None
                strict-transport-security: max-age=31536000; includeSubDomains; preload
                access-control-allow-origin: *
                x-cache: CONFIG_NOCACHE
                accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                x-msedge-ref: Ref A: 21426D2C6DF240C69DEA0ED2D86D1A75 Ref B: LON04EDGE1007 Ref C: 2024-05-11T21:31:11Z
                date: Sat, 11 May 2024 21:31:10 GMT
              • flag-nl
                GET
                https://www.bing.com/aes/c.gif?RG=b77222adec554dbea8abce99661ac9a3&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T134314Z&adUnitId=11730597&localId=w:465F5D2A-B062-9966-D2D4-950980DD8E0E&deviceId=6966564702272893
                Remote address:
                23.62.61.160:443
                Request
                GET /aes/c.gif?RG=b77222adec554dbea8abce99661ac9a3&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T134314Z&adUnitId=11730597&localId=w:465F5D2A-B062-9966-D2D4-950980DD8E0E&deviceId=6966564702272893 HTTP/2.0
                host: www.bing.com
                accept-encoding: gzip, deflate
                user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                cookie: MUID=276F8B7CCB6465FD3D009F00CA8464D4
                Response
                HTTP/2.0 200
                cache-control: private,no-store
                pragma: no-cache
                vary: Origin
                p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
                accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                x-msedge-ref: Ref A: F75E461DF0CC4A55AD188349BACCEAC0 Ref B: BRU30EDGE0511 Ref C: 2024-05-11T21:31:10Z
                content-length: 0
                date: Sat, 11 May 2024 21:31:11 GMT
                set-cookie: _EDGE_S=SID=181988E44FFC6BAA34259C984E906AC9; path=/; httponly; domain=bing.com
                set-cookie: MUIDB=276F8B7CCB6465FD3D009F00CA8464D4; path=/; httponly; expires=Thu, 05-Jun-2025 21:31:11 GMT
                alt-svc: h3=":443"; ma=93600
                x-cdn-traceid: 0.9c3d3e17.1715463070.700a37f
              • flag-us
                DNS
                240.197.17.2.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                240.197.17.2.in-addr.arpa
                IN PTR
                Response
                240.197.17.2.in-addr.arpa
                IN PTR
                a2-17-197-240deploystaticakamaitechnologiescom
              • flag-us
                DNS
                72.32.126.40.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                72.32.126.40.in-addr.arpa
                IN PTR
                Response
              • flag-us
                DNS
                237.197.79.204.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                237.197.79.204.in-addr.arpa
                IN PTR
                Response
              • flag-us
                DNS
                95.221.229.192.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                95.221.229.192.in-addr.arpa
                IN PTR
                Response
              • flag-us
                DNS
                160.61.62.23.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                160.61.62.23.in-addr.arpa
                IN PTR
                Response
                160.61.62.23.in-addr.arpa
                IN PTR
                a23-62-61-160deploystaticakamaitechnologiescom
              • flag-nl
                GET
                https://www.bing.com/th?id=OADD2.10239355179391_1LFCMSFC5TYGHD1FP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
                Remote address:
                23.62.61.160:443
                Request
                GET /th?id=OADD2.10239355179391_1LFCMSFC5TYGHD1FP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
                host: www.bing.com
                accept: */*
                cookie: MUID=276F8B7CCB6465FD3D009F00CA8464D4; _EDGE_S=SID=181988E44FFC6BAA34259C984E906AC9; MSPTC=59GJ8xr3_moqjMDEhhnjw-V5PyAhGTIOJG75tbf0q-c; MUIDB=276F8B7CCB6465FD3D009F00CA8464D4
                accept-encoding: gzip, deflate, br
                user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                Response
                HTTP/2.0 200
                cache-control: public, max-age=2592000
                content-type: image/png
                access-control-allow-origin: *
                access-control-allow-headers: *
                access-control-allow-methods: GET, POST, OPTIONS
                timing-allow-origin: *
                report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]}
                nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                content-length: 1463
                date: Sat, 11 May 2024 21:31:12 GMT
                alt-svc: h3=":443"; ma=93600
                x-cdn-traceid: 0.9c3d3e17.1715463072.700a7a9
              • flag-us
                DNS
                58.55.71.13.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                58.55.71.13.in-addr.arpa
                IN PTR
                Response
              • flag-us
                DNS
                86.23.85.13.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                86.23.85.13.in-addr.arpa
                IN PTR
                Response
              • flag-us
                DNS
                56.126.166.20.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                56.126.166.20.in-addr.arpa
                IN PTR
                Response
              • flag-us
                DNS
                102.90.33.23.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                102.90.33.23.in-addr.arpa
                IN PTR
                Response
                102.90.33.23.in-addr.arpa
                IN PTR
                a23-33-90-102deploystaticakamaitechnologiescom
              • flag-us
                DNS
                22.236.111.52.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                22.236.111.52.in-addr.arpa
                IN PTR
                Response
              • flag-us
                DNS
                22.236.111.52.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                22.236.111.52.in-addr.arpa
                IN PTR
              • flag-us
                DNS
                101.58.20.217.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                101.58.20.217.in-addr.arpa
                IN PTR
                Response
              • 204.79.197.237:443
                https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De82oQmh8djyLctL4Kik2wPgjVUCUyQAwn12C7PxN4A2EvPhAcxiWLkMCCfUjc4E_E4URAuEvsHocoKIEepHQKavWke_Qa44nCs4iFNsBg9AMKxKCZ6x-sJuQ1efXANolCXJBhzUVzkMh9LtVtn9szoKXQJxrNQIUj7ZuCvA2NRjGJq2y2Y%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D590e003290821430f91266193fd698fb&TIME=20240426T134314Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:465F5D2A-B062-9966-D2D4-950980DD8E0E&deviceId=6966564702272893&muid=465F5D2AB0629966D2D4950980DD8E0E
                tls, http2
                2.5kB
                 9.0kB
                 19
                17

                HTTP Request

                GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De82oQmh8djyLctL4Kik2wPgjVUCUyQAwn12C7PxN4A2EvPhAcxiWLkMCCfUjc4E_E4URAuEvsHocoKIEepHQKavWke_Qa44nCs4iFNsBg9AMKxKCZ6x-sJuQ1efXANolCXJBhzUVzkMh9LtVtn9szoKXQJxrNQIUj7ZuCvA2NRjGJq2y2Y%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D590e003290821430f91266193fd698fb&TIME=20240426T134314Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:465F5D2A-B062-9966-D2D4-950980DD8E0E&deviceId=6966564702272893&muid=465F5D2AB0629966D2D4950980DD8E0E

                HTTP Response

                204

                HTTP Request

                GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De82oQmh8djyLctL4Kik2wPgjVUCUyQAwn12C7PxN4A2EvPhAcxiWLkMCCfUjc4E_E4URAuEvsHocoKIEepHQKavWke_Qa44nCs4iFNsBg9AMKxKCZ6x-sJuQ1efXANolCXJBhzUVzkMh9LtVtn9szoKXQJxrNQIUj7ZuCvA2NRjGJq2y2Y%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D590e003290821430f91266193fd698fb&TIME=20240426T134314Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:465F5D2A-B062-9966-D2D4-950980DD8E0E&deviceId=6966564702272893&muid=465F5D2AB0629966D2D4950980DD8E0E

                HTTP Response

                204
              • 23.62.61.160:443
                https://www.bing.com/aes/c.gif?RG=b77222adec554dbea8abce99661ac9a3&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T134314Z&adUnitId=11730597&localId=w:465F5D2A-B062-9966-D2D4-950980DD8E0E&deviceId=6966564702272893
                tls, http2
                1.4kB
                 5.3kB
                 16
                11

                HTTP Request

                GET https://www.bing.com/aes/c.gif?RG=b77222adec554dbea8abce99661ac9a3&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T134314Z&adUnitId=11730597&localId=w:465F5D2A-B062-9966-D2D4-950980DD8E0E&deviceId=6966564702272893

                HTTP Response

                200
              • 23.62.61.160:443
                https://www.bing.com/th?id=OADD2.10239355179391_1LFCMSFC5TYGHD1FP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
                tls, http2
                1.7kB
                 6.8kB
                 18
                13

                HTTP Request

                GET https://www.bing.com/th?id=OADD2.10239355179391_1LFCMSFC5TYGHD1FP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

                HTTP Response

                200
              • 8.8.8.8:53
                196.249.167.52.in-addr.arpa
                dns
                73 B
                 147 B
                 1
                1

                DNS Request

                196.249.167.52.in-addr.arpa

              • 8.8.8.8:53
                g.bing.com
                dns
                56 B
                 151 B
                 1
                1

                DNS Request

                g.bing.com

                DNS Response

                204.79.197.237
                13.107.21.237

              • 8.8.8.8:53
                240.197.17.2.in-addr.arpa
                dns
                71 B
                 135 B
                 1
                1

                DNS Request

                240.197.17.2.in-addr.arpa

              • 8.8.8.8:53
                72.32.126.40.in-addr.arpa
                dns
                71 B
                 157 B
                 1
                1

                DNS Request

                72.32.126.40.in-addr.arpa

              • 8.8.8.8:53
                237.197.79.204.in-addr.arpa
                dns
                73 B
                 143 B
                 1
                1

                DNS Request

                237.197.79.204.in-addr.arpa

              • 8.8.8.8:53
                95.221.229.192.in-addr.arpa
                dns
                73 B
                 144 B
                 1
                1

                DNS Request

                95.221.229.192.in-addr.arpa

              • 8.8.8.8:53
                160.61.62.23.in-addr.arpa
                dns
                71 B
                 135 B
                 1
                1

                DNS Request

                160.61.62.23.in-addr.arpa

              • 8.8.8.8:53
                58.55.71.13.in-addr.arpa
                dns
                70 B
                 144 B
                 1
                1

                DNS Request

                58.55.71.13.in-addr.arpa

              • 8.8.8.8:53
                86.23.85.13.in-addr.arpa
                dns
                70 B
                 144 B
                 1
                1

                DNS Request

                86.23.85.13.in-addr.arpa

              • 8.8.8.8:53
                56.126.166.20.in-addr.arpa
                dns
                72 B
                 158 B
                 1
                1

                DNS Request

                56.126.166.20.in-addr.arpa

              • 8.8.8.8:53
                102.90.33.23.in-addr.arpa
                dns
                71 B
                 135 B
                 1
                1

                DNS Request

                102.90.33.23.in-addr.arpa

              • 8.8.8.8:53
                22.236.111.52.in-addr.arpa
                dns
                144 B
                 158 B
                 2
                1

                DNS Request

                22.236.111.52.in-addr.arpa

                DNS Request

                22.236.111.52.in-addr.arpa

              • 8.8.8.8:53
                101.58.20.217.in-addr.arpa
                dns
                72 B
                 132 B
                 1
                1

                DNS Request

                101.58.20.217.in-addr.arpa

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              Windows Management Instrumentation

              1
              T1047

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Defense Evasion

              Impair Defenses

              1
              T1562

              Disable or Modify System Firewall

              1
              T1562.004

              Indicator Removal

              3
              T1070

              File Deletion

              3
              T1070.004

              Modify Registry

              1
              T1112

              Credential Access

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              Peripheral Device Discovery

              1
              T1120

              Query Registry

              3
              T1012

              System Information Discovery

              3
              T1082

              Lateral Movement

              Collection

              Data from Local System

              1
              T1005

              Command and Control

              Exfiltration

              Impact

              Inhibit System Recovery

              4
              T1490

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.id[788BD37A-2930].[restorefiles69@cock.li].eking
                Filesize

                2.7MB

                MD5

                02e7edbc3f9886c7ce69d37794e55f5e

                SHA1

                7961c8542cedba7a30c4fddcf7faa308c1d73436

                SHA256

                cf2e3612abf7a5cda9125b9e55880cd66c18ee3ad697c33dcfc1c34919f85c71

                SHA512

                d4701654ab6c752131c1a2b7c2ac2170b20c6510408c23b9ccbc47bd2df836b28dd44efd2baabf4c16b86391ba056834817abc57ab257532251d182b84fc76c0

                Download Submit

              • C:\info.hta
                Filesize

                4KB

                MD5

                19f38a45ed26b1b87a789637e4d5261c

                SHA1

                24212528f7a76a66ac30b49522d382dc18de73ce

                SHA256

                15273800690928044209393e9b3d0e8ab904bbdb621fd18852a7acc79de2083a

                SHA512

                247cd5de3b770e5cf9b84e04f71634b4ae54374b9e17333782f7a5b7b8b75ad22d04f98e04334c5ad24a65a4181beafc3ccb177546c09a962042e4726db630b3

                Download Submit

              We care about your privacy.

              This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.