hxxps://www[.]bing[.]com/aclick?ld=e8gF2h9kly-xaAGWJrRNhsEjVUCUx67YMGtsE6xDRF2pHyzGB_INpyB6aVNgEKI2xTm-XAByLBX7hQYiLUyBqD0f_8qmxIuTx70GeZDZ3CK1PJhMjVzYppuZKEZ2c5u88U6sk2YYjmVuoiWGWS2tJhFAe4fb5dS02IMkNT55xfUGjmgIz3NW9g05UJhx-Yb_ltWaQd4w&u=aHR0cHMlM2ElMmYlMmZqanNwbG9pdC5lbi5zb2Z0b25pYy5jb20lMmYlM2Z1dG1fc291cmNlJTNkYmluZyUyNnV0bV9tZWRpdW0lM2RwYWlkJTI2dXRtX2NhbXBhaWduJTNkQmluZ19FTl9JRV9EU0FfRGVza3RvcF8yJTI2bXNjbGtpZCUzZDA3NjcwZjMyOTM2YzE1ODNhYTY2NjllY2EzODNkY2Ez&rlid=07670f32936c1583aa6669eca383dca3&ntb=1

General

Target

https://www.bing.com/aclick?ld=e8gF2h9kly-xaAGWJrRNhsEjVUCUx67YMGtsE6xDRF2pHyzGB_INpyB6aVNgEKI2xTm-XAByLBX7hQYiLUyBqD0f_8qmxIuTx70GeZDZ3CK1PJhMjVzYppuZKEZ2c5u88U6sk2YYjmVuoiWGWS2tJhFAe4fb5dS02IMkNT55xfUGjmgIz3NW9g05UJhx-Yb_ltWaQd4w&u=aHR0cHMlM2ElMmYlMmZqanNwbG9pdC5lbi5zb2Z0b25pYy5jb20lMmYlM2Z1dG1fc291cmNlJTNkYmluZyUyNnV0bV9tZWRpdW0lM2RwYWlkJTI2dXRtX2NhbXBhaWduJTNkQmluZ19FTl9JRV9EU0FfRGVza3RvcF8yJTI2bXNjbGtpZCUzZDA3NjcwZjMyOTM2YzE1ODNhYTY2NjllY2EzODNkY2Ez&rlid=07670f32936c1583aa6669eca383dca3&ntb=1
Sample

240908-3zgpwa1hnk

Score

8^/10

Malware Config

Targets

- Target
  
  https://www.bing.com/aclick?ld=e8gF2h9kly-xaAGWJrRNhsEjVUCUx67YMGtsE6xDRF2pHyzGB_INpyB6aVNgEKI2xTm-XAByLBX7hQYiLUyBqD0f_8qmxIuTx70GeZDZ3CK1PJhMjVzYppuZKEZ2c5u88U6sk2YYjmVuoiWGWS2tJhFAe4fb5dS02IMkNT55xfUGjmgIz3NW9g05UJhx-Yb_ltWaQd4w&u=aHR0cHMlM2ElMmYlMmZqanNwbG9pdC5lbi5zb2Z0b25pYy5jb20lMmYlM2Z1dG1fc291cmNlJTNkYmluZyUyNnV0bV9tZWRpdW0lM2RwYWlkJTI2dXRtX2NhbXBhaWduJTNkQmluZ19FTl9JRV9EU0FfRGVza3RvcF8yJTI2bXNjbGtpZCUzZDA3NjcwZjMyOTM2YzE1ODNhYTY2NjllY2EzODNkY2Ez&rlid=07670f32936c1583aa6669eca383dca3&ntb=1
Score

8^/10

defense_evasion discovery evasion motw persistence phishing privilege_escalation trojan
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Mark of the Web detected: This indicates that the page was originally saved or cloned.
  phishing motw
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1