Overview
overview
4Static
static
3klist.exe
windows10-2004-x64
1ksetup.exe
windows10-2004-x64
1ktmutil.exe
windows10-2004-x64
1la57setup.exe
windows10-2004-x64
1label.exe
windows10-2004-x64
1licensingdiag.exe
windows10-2004-x64
3lodctr.exe
windows10-2004-x64
1logagent.exe
windows10-2004-x64
1logman.exe
windows10-2004-x64
1lpkinstall.exe
windows10-2004-x64
1lpksetup.exe
windows10-2004-x64
1lpremove.exe
windows10-2004-x64
1lsass.exe
windows10-2004-x64
1makecab.exe
windows10-2004-x64
1manage-bde.exe
windows10-2004-x64
1mblctr.exe
windows10-2004-x64
1mcbuilder.exe
windows10-2004-x64
4mfpmp.exe
windows10-2004-x64
1mmc.exe
windows10-2004-x64
1mmgaserver.exe
windows10-2004-x64
1mobsync.exe
windows10-2004-x64
3mountvol.exe
windows10-2004-x64
1mpnotify.exe
windows10-2004-x64
1msconfig.exe
windows10-2004-x64
1msdt.exe
windows10-2004-x64
1msdtc.exe
windows10-2004-x64
1msfeedssync.exe
windows10-2004-x64
1mshta.exe
windows10-2004-x64
1msiexec.exe
windows10-2004-x64
1msinfo32.exe
windows10-2004-x64
1msra.exe
windows10-2004-x64
1mtstocom.exe
windows10-2004-x64
1Resubmissions
23/08/2024, 16:00 UTC
240823-tf47dsteqe 623/08/2024, 15:32 UTC
240823-sy293sseld 423/08/2024, 15:18 UTC
240823-sp1d5athqk 823/08/2024, 14:12 UTC
240823-rjcv7sydnd 723/08/2024, 02:33 UTC
240823-c17dta1cpd 723/08/2024, 02:11 UTC
240823-cmbpzszelg 423/08/2024, 02:00 UTC
240823-ce59mazbnh 423/08/2024, 01:37 UTC
240823-b1992a1dmm 523/08/2024, 01:24 UTC
240823-bsm5jazhpp 523/08/2024, 00:51 UTC
240823-a7p21awhld 6Analysis
-
max time kernel
143s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 02:11 UTC
Static task
static1
Behavioral task
behavioral1
Sample
klist.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
ksetup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
ktmutil.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
la57setup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
label.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral6
Sample
licensingdiag.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
lodctr.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
logagent.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
logman.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
lpkinstall.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
lpksetup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
lpremove.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
lsass.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral14
Sample
makecab.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
manage-bde.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
mblctr.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
mcbuilder.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral18
Sample
mfpmp.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
mmc.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral20
Sample
mmgaserver.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
mobsync.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral22
Sample
mountvol.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
mpnotify.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral24
Sample
msconfig.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
msdt.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral26
Sample
msdtc.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
msfeedssync.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral28
Sample
mshta.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
msiexec.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral30
Sample
msinfo32.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
msra.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral32
Sample
mtstocom.exe
Resource
win10v2004-20240802-en
General
-
Target
mtstocom.exe
-
Size
156KB
-
MD5
46f315deccc2b9fe64256f61f2f9733a
-
SHA1
8c222b146997d75d95c67647ac0256f86d61dc39
-
SHA256
b066374604077916f6aca26484d90f2890abcc8a7ebb755ece22e1d45827bceb
-
SHA512
f16b1da114c982bd8abd76a91a78df52cf4691d2611691a04696d785690a9955a174f69db7679126024eb10461a2e4cd21a4a415098b946d810ec515c15dd201
-
SSDEEP
3072:yqyT5mVq3AsDhUBs6mh8KgjfeB2y61MuSaLjG:yFmTsDhUK6m+KgbeBV61MuSaLj
Malware Config
Signatures
Processes
Network
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEax-0001.ax-msedge.netax-0001.ax-msedge.netIN A150.171.28.10ax-0001.ax-msedge.netIN A150.171.27.10
-
Remote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request73.144.22.2.in-addr.arpaIN PTRResponse73.144.22.2.in-addr.arpaIN PTRa2-22-144-73deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request73.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request55.36.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request147.142.123.92.in-addr.arpaIN PTRResponse147.142.123.92.in-addr.arpaIN PTRa92-123-142-147deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request43.58.199.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEax-0001.ax-msedge.netax-0001.ax-msedge.netIN A150.171.27.10ax-0001.ax-msedge.netIN A150.171.28.10
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239350921841_16W48F683TPQ33D77&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239350921841_16W48F683TPQ33D77&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 520238
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 470B0A57EA7A41A0B0A643915781DEEB Ref B: LON04EDGE1211 Ref C: 2024-08-23T02:19:21Z
date: Fri, 23 Aug 2024 02:19:21 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239350921833_1A6LL0IFX045S227F&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239350921833_1A6LL0IFX045S227F&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 607276
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: AA4D605C95B54DE888810008FD177AB9 Ref B: LON04EDGE1211 Ref C: 2024-08-23T02:19:21Z
date: Fri, 23 Aug 2024 02:19:21 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239350921811_1A0NKCRDFZEZBWZV1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239350921811_1A0NKCRDFZEZBWZV1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 584544
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 4DA9C10A461E4812BAE0D34FC915398E Ref B: LON04EDGE1211 Ref C: 2024-08-23T02:19:21Z
date: Fri, 23 Aug 2024 02:19:21 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239350921810_1QNNXZ5VF3EHP23AT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239350921810_1QNNXZ5VF3EHP23AT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 536336
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 00F7ECB4005F45BC8F04A2197AC4E0F5 Ref B: LON04EDGE1211 Ref C: 2024-08-23T02:19:21Z
date: Fri, 23 Aug 2024 02:19:21 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239370639595_1MX6CE6U5QJ1LNKB2&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239370639595_1MX6CE6U5QJ1LNKB2&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 664170
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 87BF06E4894A4BA9AE9665EE5FDC2D02 Ref B: LON04EDGE1211 Ref C: 2024-08-23T02:19:21Z
date: Fri, 23 Aug 2024 02:19:21 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239370639606_1UY6VCV79VNDR5KH5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239370639606_1UY6VCV79VNDR5KH5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 612524
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 23CA0ADA78CC42D3B45CE74EA3A09158 Ref B: LON04EDGE1211 Ref C: 2024-08-23T02:19:22Z
date: Fri, 23 Aug 2024 02:19:21 GMT
-
Remote address:8.8.8.8:53Request10.27.171.150.in-addr.arpaIN PTRResponse
-
34.5kB 967.1kB 708 705
-
1.2kB 6.9kB 15 13
-
1.2kB 6.9kB 15 13
-
1.2kB 6.9kB 15 13
-
1.2kB 6.9kB 15 13
-
150.171.27.10:443https://tse1.mm.bing.net/th?id=OADD2.10239370639606_1UY6VCV79VNDR5KH5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90tls, http2145.0kB 3.6MB 2634 2629
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239350921841_16W48F683TPQ33D77&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239350921833_1A6LL0IFX045S227F&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239350921811_1A0NKCRDFZEZBWZV1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239350921810_1QNNXZ5VF3EHP23AT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239370639595_1MX6CE6U5QJ1LNKB2&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239370639606_1UY6VCV79VNDR5KH5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Response
200
-
62 B 170 B 1 1
DNS Request
tse1.mm.bing.net
DNS Response
150.171.28.10150.171.27.10
-
72 B 158 B 1 1
DNS Request
28.118.140.52.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
73.144.22.2.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
73.159.190.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
55.36.223.20.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
104.219.191.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
50.23.12.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
147.142.123.92.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
43.58.199.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.227.111.52.in-addr.arpa
-
62 B 170 B 1 1
DNS Request
tse1.mm.bing.net
DNS Response
150.171.27.10150.171.28.10
-
72 B 158 B 1 1
DNS Request
10.27.171.150.in-addr.arpa