hxxps://www[.]bing[.]com/aclk?ld=e8ZFnuUs2MB1lWq56e0w-A0jVUCUzloN3KqzCsDcISn_6jz6A27gaIOyQNaHSFzhX_0G0PV2lhX9E41TH4R-16hiPKzihkBGPRSOKRo9UUoGlyQN0J_pB_NBSw0bOf-rk_sOS99gf5XFfGXAAN7ytHoQhk78C25FkZNJpnfl_I7_iU2xfis9aGjY5PdOA-oXyQ_EtjVw&u=aHR0cHMlM2ElMmYlMmZ3d3cudG90YWxhdi5jb20lMmZfZl8lMmY1ZDdmYTU0YTRkYzgyJTJmY2xpY2slMmZiaW5nJTJmdXNhMSUyZmZyZWUtd2luZG93cy1hbnRpdmlydXMlM2Ztc2Nsa2lkJTNkYWNkOGZiMGIxM2UwMTI5NTI0Y2Y5ZDgwMDU5MGRkOWM&rlid=acd8fb0b13e0129524cf9d800590dd9c&ntb=1

General

Target

https://www.bing.com/aclk?ld=e8ZFnuUs2MB1lWq56e0w-A0jVUCUzloN3KqzCsDcISn_6jz6A27gaIOyQNaHSFzhX_0G0PV2lhX9E41TH4R-16hiPKzihkBGPRSOKRo9UUoGlyQN0J_pB_NBSw0bOf-rk_sOS99gf5XFfGXAAN7ytHoQhk78C25FkZNJpnfl_I7_iU2xfis9aGjY5PdOA-oXyQ_EtjVw&u=aHR0cHMlM2ElMmYlMmZ3d3cudG90YWxhdi5jb20lMmZfZl8lMmY1ZDdmYTU0YTRkYzgyJTJmY2xpY2slMmZiaW5nJTJmdXNhMSUyZmZyZWUtd2luZG93cy1hbnRpdmlydXMlM2Ztc2Nsa2lkJTNkYWNkOGZiMGIxM2UwMTI5NTI0Y2Y5ZDgwMDU5MGRkOWM&rlid=acd8fb0b13e0129524cf9d800590dd9c&ntb=1
Sample

240707-2drsaa1gng

Score

8^/10

Malware Config

Targets

- Target
  
  https://www.bing.com/aclk?ld=e8ZFnuUs2MB1lWq56e0w-A0jVUCUzloN3KqzCsDcISn_6jz6A27gaIOyQNaHSFzhX_0G0PV2lhX9E41TH4R-16hiPKzihkBGPRSOKRo9UUoGlyQN0J_pB_NBSw0bOf-rk_sOS99gf5XFfGXAAN7ytHoQhk78C25FkZNJpnfl_I7_iU2xfis9aGjY5PdOA-oXyQ_EtjVw&u=aHR0cHMlM2ElMmYlMmZ3d3cudG90YWxhdi5jb20lMmZfZl8lMmY1ZDdmYTU0YTRkYzgyJTJmY2xpY2slMmZiaW5nJTJmdXNhMSUyZmZyZWUtd2luZG93cy1hbnRpdmlydXMlM2Ztc2Nsa2lkJTNkYWNkOGZiMGIxM2UwMTI5NTI0Y2Y5ZDgwMDU5MGRkOWM&rlid=acd8fb0b13e0129524cf9d800590dd9c&ntb=1
Score

8^/10

discovery execution persistence privilege_escalation spyware stealer upx
- Creates new service(s)
  persistence execution
- Downloads MZ/PE file
- Drops file in Drivers directory
- Event Triggered Execution: AppInit DLLs
  Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
  persistence privilege_escalation
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1