Overview

overview

10

Static

static

3

3eee238f20...b3.exe

windows7-x64

3

3eee238f20...b3.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    105s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/03/2025, 21:17 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3eee238f20f79e74c15bb04213c3cefed673652ccc5857bd1ab85089394622b3.exe

  • Size

    3.0MB

  • MD5

    b89c758dc20f12b23f5aa2148d2a86a9

  • SHA1

    49870b72f1fd645e6e3787bd450c2e163775e634

  • SHA256

    3eee238f20f79e74c15bb04213c3cefed673652ccc5857bd1ab85089394622b3

  • SHA512

    94ad1088762e8be5cde0ccfc474293e80bf76568475259daa48169dd41d8591d38ddce7d21a2a26c81ddab880ee99a1dbe9435985dc8990ae558275cbd2d33d9

  • SSDEEP

    49152:OZ4rujE/CLlVl80CdSI3LdmLgWtAjkhAd86LqmQKzeFH/LNqAznwMt:O+ruj+CLflabdSgGhb6OFGUwC

Score
10/10
salitybackdoorbootkitdefense_evasiondiscoverypersistencetrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
    defense_evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Sality family
    sality
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 6 IoCs
    defense_evasiontrojan
  • Windows security modification 2 TTPs 7 IoCs
    defense_evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:792
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:800
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:380
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2468
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:2492
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:2588
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3532
                  • C:\Users\Admin\AppData\Local\Temp\3eee238f20f79e74c15bb04213c3cefed673652ccc5857bd1ab85089394622b3.exe
                    "C:\Users\Admin\AppData\Local\Temp\3eee238f20f79e74c15bb04213c3cefed673652ccc5857bd1ab85089394622b3.exe"
                    2⤵
                    • Modifies firewall policy service
                    • UAC bypass
                    • Windows security bypass
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Writes to the Master Boot Record (MBR)
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:2216
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                  1⤵
                    PID:3696
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    1⤵
                      PID:3868
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:4024
                      • C:\Windows\System32\RuntimeBroker.exe
                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                        1⤵
                          PID:3056
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:3308
                          • C:\Windows\System32\RuntimeBroker.exe
                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                            1⤵
                              PID:4136
                            • C:\Windows\System32\RuntimeBroker.exe
                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                              1⤵
                                PID:5492
                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                                1⤵
                                  PID:3772
                                • C:\Windows\system32\backgroundTaskHost.exe
                                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
                                  1⤵
                                    PID:5276
                                  • C:\Windows\system32\backgroundTaskHost.exe
                                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                    1⤵
                                      PID:5572

                                    Network

                                    • flag-us
                                      DNS
                                      g.bing.com
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      g.bing.com
                                      IN A
                                      Response
                                      g.bing.com
                                      IN CNAME
                                      g-bing-com.ax-0001.ax-msedge.net
                                      g-bing-com.ax-0001.ax-msedge.net
                                      IN CNAME
                                      ax-0001.ax-msedge.net
                                      ax-0001.ax-msedge.net
                                      IN A
                                      150.171.28.10
                                      ax-0001.ax-msedge.net
                                      IN A
                                      150.171.27.10
                                    • flag-us
                                      GET
                                      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6c6abf2f91aa44979ef296072745a296&localId=w:F0FEBB8E-8133-CF04-82BA-93AC06D5D739&deviceId=6896216935726017&anid=
                                      backgroundTaskHost.exe
                                      Remote address:
                                      150.171.28.10:443
                                      Request
                                      GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6c6abf2f91aa44979ef296072745a296&localId=w:F0FEBB8E-8133-CF04-82BA-93AC06D5D739&deviceId=6896216935726017&anid= HTTP/2.0
                                      host: g.bing.com
                                      accept-encoding: gzip, deflate
                                      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                                      Response
                                      HTTP/2.0 204
                                      cache-control: no-cache, must-revalidate
                                      pragma: no-cache
                                      expires: Fri, 01 Jan 1990 00:00:00 GMT
                                      set-cookie: MUID=283A8E88DF83688C3D3F9B35DE3869FB; domain=.bing.com; expires=Wed, 22-Apr-2026 21:17:50 GMT; path=/; SameSite=None; Secure; Priority=High;
                                      strict-transport-security: max-age=31536000; includeSubDomains; preload
                                      access-control-allow-origin: *
                                      x-cache: CONFIG_NOCACHE
                                      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                      x-msedge-ref: Ref A: DFA68615116B4CE999C4804AA930C9EF Ref B: LON04EDGE0909 Ref C: 2025-03-28T21:17:50Z
                                      date: Fri, 28 Mar 2025 21:17:50 GMT
                                    • flag-us
                                      GET
                                      https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=6c6abf2f91aa44979ef296072745a296&localId=w:F0FEBB8E-8133-CF04-82BA-93AC06D5D739&deviceId=6896216935726017&anid=
                                      backgroundTaskHost.exe
                                      Remote address:
                                      150.171.28.10:443
                                      Request
                                      GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=6c6abf2f91aa44979ef296072745a296&localId=w:F0FEBB8E-8133-CF04-82BA-93AC06D5D739&deviceId=6896216935726017&anid= HTTP/2.0
                                      host: g.bing.com
                                      accept-encoding: gzip, deflate
                                      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                                      cookie: MUID=283A8E88DF83688C3D3F9B35DE3869FB
                                      Response
                                      HTTP/2.0 204
                                      cache-control: no-cache, must-revalidate
                                      pragma: no-cache
                                      expires: Fri, 01 Jan 1990 00:00:00 GMT
                                      set-cookie: MSPTC=hPVghbFWm8YMwAma_DtcXoNEZ4STrVTOn0DS1aH8sQM; domain=.bing.com; expires=Wed, 22-Apr-2026 21:17:50 GMT; path=/; Partitioned; secure; SameSite=None
                                      strict-transport-security: max-age=31536000; includeSubDomains; preload
                                      access-control-allow-origin: *
                                      x-cache: CONFIG_NOCACHE
                                      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                      x-msedge-ref: Ref A: 8072516EC6214EFBB70B43FDC304DABD Ref B: LON04EDGE0909 Ref C: 2025-03-28T21:17:50Z
                                      date: Fri, 28 Mar 2025 21:17:50 GMT
                                    • flag-us
                                      GET
                                      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6c6abf2f91aa44979ef296072745a296&localId=w:F0FEBB8E-8133-CF04-82BA-93AC06D5D739&deviceId=6896216935726017&anid=
                                      backgroundTaskHost.exe
                                      Remote address:
                                      150.171.28.10:443
                                      Request
                                      GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6c6abf2f91aa44979ef296072745a296&localId=w:F0FEBB8E-8133-CF04-82BA-93AC06D5D739&deviceId=6896216935726017&anid= HTTP/2.0
                                      host: g.bing.com
                                      accept-encoding: gzip, deflate
                                      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                                      cookie: MUID=283A8E88DF83688C3D3F9B35DE3869FB; MSPTC=hPVghbFWm8YMwAma_DtcXoNEZ4STrVTOn0DS1aH8sQM
                                      Response
                                      HTTP/2.0 204
                                      cache-control: no-cache, must-revalidate
                                      pragma: no-cache
                                      expires: Fri, 01 Jan 1990 00:00:00 GMT
                                      strict-transport-security: max-age=31536000; includeSubDomains; preload
                                      access-control-allow-origin: *
                                      x-cache: CONFIG_NOCACHE
                                      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                      x-msedge-ref: Ref A: D254D4F9DB3C4FBFAA75BD2CC1AF3989 Ref B: LON04EDGE0909 Ref C: 2025-03-28T21:17:50Z
                                      date: Fri, 28 Mar 2025 21:17:50 GMT
                                    • flag-us
                                      DNS
                                      tse1.mm.bing.net
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      tse1.mm.bing.net
                                      IN A
                                      Response
                                      tse1.mm.bing.net
                                      IN CNAME
                                      mm-mm.bing.net.trafficmanager.net
                                      mm-mm.bing.net.trafficmanager.net
                                      IN CNAME
                                      ax-0001.ax-msedge.net
                                      ax-0001.ax-msedge.net
                                      IN A
                                      150.171.28.10
                                      ax-0001.ax-msedge.net
                                      IN A
                                      150.171.27.10
                                    • flag-us
                                      GET
                                      https://tse1.mm.bing.net/th?id=OADD2.10239360264291_1OMXAE3VFGJI9A76K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                                      Remote address:
                                      150.171.28.10:443
                                      Request
                                      GET /th?id=OADD2.10239360264291_1OMXAE3VFGJI9A76K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
                                      host: tse1.mm.bing.net
                                      accept: */*
                                      accept-encoding: gzip, deflate, br
                                      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                      Response
                                      HTTP/2.0 200
                                      cache-control: public, max-age=2592000
                                      content-length: 585223
                                      content-type: image/jpeg
                                      x-cache: TCP_HIT
                                      access-control-allow-origin: *
                                      access-control-allow-headers: *
                                      access-control-allow-methods: GET, POST, OPTIONS
                                      timing-allow-origin: *
                                      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                                      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                      x-msedge-ref: Ref A: 6B161868DE614910A457750ED4C3B31E Ref B: LON04EDGE1118 Ref C: 2025-03-28T21:18:24Z
                                      date: Fri, 28 Mar 2025 21:18:23 GMT
                                    • flag-us
                                      GET
                                      https://tse1.mm.bing.net/th?id=OADD2.10239340418607_15GIAV8TOK7UC4KMM&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                                      Remote address:
                                      150.171.28.10:443
                                      Request
                                      GET /th?id=OADD2.10239340418607_15GIAV8TOK7UC4KMM&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
                                      host: tse1.mm.bing.net
                                      accept: */*
                                      accept-encoding: gzip, deflate, br
                                      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                      Response
                                      HTTP/2.0 200
                                      cache-control: public, max-age=2592000
                                      content-length: 641946
                                      content-type: image/jpeg
                                      x-cache: TCP_HIT
                                      access-control-allow-origin: *
                                      access-control-allow-headers: *
                                      access-control-allow-methods: GET, POST, OPTIONS
                                      timing-allow-origin: *
                                      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                                      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                      x-msedge-ref: Ref A: A6F9797A4D4240C283FBD4E175099EE0 Ref B: LON04EDGE1118 Ref C: 2025-03-28T21:18:24Z
                                      date: Fri, 28 Mar 2025 21:18:23 GMT
                                    • flag-us
                                      GET
                                      https://tse1.mm.bing.net/th?id=OADD2.10239360125545_1ABMDCTEZ7ZJRMZDX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                                      Remote address:
                                      150.171.28.10:443
                                      Request
                                      GET /th?id=OADD2.10239360125545_1ABMDCTEZ7ZJRMZDX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
                                      host: tse1.mm.bing.net
                                      accept: */*
                                      accept-encoding: gzip, deflate, br
                                      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                      Response
                                      HTTP/2.0 200
                                      cache-control: public, max-age=2592000
                                      content-length: 493712
                                      content-type: image/jpeg
                                      x-cache: TCP_HIT
                                      access-control-allow-origin: *
                                      access-control-allow-headers: *
                                      access-control-allow-methods: GET, POST, OPTIONS
                                      timing-allow-origin: *
                                      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                                      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                      x-msedge-ref: Ref A: 56172B73B5384A8EACFF3620170F797B Ref B: LON04EDGE1118 Ref C: 2025-03-28T21:18:24Z
                                      date: Fri, 28 Mar 2025 21:18:23 GMT
                                    • flag-us
                                      GET
                                      https://tse1.mm.bing.net/th?id=OADD2.10239360125544_1U4JKLLGDS2L5LDU8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                                      Remote address:
                                      150.171.28.10:443
                                      Request
                                      GET /th?id=OADD2.10239360125544_1U4JKLLGDS2L5LDU8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
                                      host: tse1.mm.bing.net
                                      accept: */*
                                      accept-encoding: gzip, deflate, br
                                      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                      Response
                                      HTTP/2.0 200
                                      cache-control: public, max-age=2592000
                                      content-length: 619595
                                      content-type: image/jpeg
                                      x-cache: TCP_HIT
                                      access-control-allow-origin: *
                                      access-control-allow-headers: *
                                      access-control-allow-methods: GET, POST, OPTIONS
                                      timing-allow-origin: *
                                      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                                      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                      x-msedge-ref: Ref A: 3B5BF14706D34FD2AFDC20E659F679E6 Ref B: LON04EDGE1118 Ref C: 2025-03-28T21:18:24Z
                                      date: Fri, 28 Mar 2025 21:18:23 GMT
                                    • flag-us
                                      GET
                                      https://tse1.mm.bing.net/th?id=OADD2.10239340418608_1Q6O2BHJAWL0R6QXX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                                      Remote address:
                                      150.171.28.10:443
                                      Request
                                      GET /th?id=OADD2.10239340418608_1Q6O2BHJAWL0R6QXX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
                                      host: tse1.mm.bing.net
                                      accept: */*
                                      accept-encoding: gzip, deflate, br
                                      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                      Response
                                      HTTP/2.0 200
                                      cache-control: public, max-age=2592000
                                      content-length: 573469
                                      content-type: image/jpeg
                                      x-cache: TCP_HIT
                                      access-control-allow-origin: *
                                      access-control-allow-headers: *
                                      access-control-allow-methods: GET, POST, OPTIONS
                                      timing-allow-origin: *
                                      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                                      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                      x-msedge-ref: Ref A: D2F26C52DB394A329357B4A60599034B Ref B: LON04EDGE1118 Ref C: 2025-03-28T21:18:24Z
                                      date: Fri, 28 Mar 2025 21:18:24 GMT
                                    • flag-us
                                      GET
                                      https://tse1.mm.bing.net/th?id=OADD2.10239360264303_1FV8HLP8B8WOIRSCV&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                                      Remote address:
                                      150.171.28.10:443
                                      Request
                                      GET /th?id=OADD2.10239360264303_1FV8HLP8B8WOIRSCV&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
                                      host: tse1.mm.bing.net
                                      accept: */*
                                      accept-encoding: gzip, deflate, br
                                      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                                      Response
                                      HTTP/2.0 200
                                      cache-control: public, max-age=2592000
                                      content-length: 401499
                                      content-type: image/jpeg
                                      x-cache: TCP_HIT
                                      access-control-allow-origin: *
                                      access-control-allow-headers: *
                                      access-control-allow-methods: GET, POST, OPTIONS
                                      timing-allow-origin: *
                                      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                                      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                                      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                      x-msedge-ref: Ref A: 0347C348EA2D43FDB841AC9F0C96E7D1 Ref B: LON04EDGE1118 Ref C: 2025-03-28T21:18:25Z
                                      date: Fri, 28 Mar 2025 21:18:24 GMT
                                    • flag-us
                                      DNS
                                      c.pki.goog
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      c.pki.goog
                                      IN A
                                      Response
                                      c.pki.goog
                                      IN CNAME
                                      pki-goog.l.google.com
                                      pki-goog.l.google.com
                                      IN A
                                      142.250.187.195
                                    • flag-gb
                                      GET
                                      http://c.pki.goog/r/r1.crl
                                      Remote address:
                                      142.250.187.195:80
                                      Request
                                      GET /r/r1.crl HTTP/1.1
                                      Cache-Control: max-age = 3000
                                      Connection: Keep-Alive
                                      Accept: */*
                                      If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT
                                      User-Agent: Microsoft-CryptoAPI/10.0
                                      Host: c.pki.goog
                                      Response
                                      HTTP/1.1 304 Not Modified
                                      Date: Fri, 28 Mar 2025 20:31:00 GMT
                                      Expires: Fri, 28 Mar 2025 21:21:00 GMT
                                      Age: 2896
                                      Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
                                      Cache-Control: public, max-age=3000
                                      Vary: Accept-Encoding
                                    • 150.171.28.10:443
                                      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6c6abf2f91aa44979ef296072745a296&localId=w:F0FEBB8E-8133-CF04-82BA-93AC06D5D739&deviceId=6896216935726017&anid=
                                      tls, http2
                                      backgroundTaskHost.exe
                                      2.0kB
                                       9.4kB
                                       22
                                      19

                                      HTTP Request

                                      GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6c6abf2f91aa44979ef296072745a296&localId=w:F0FEBB8E-8133-CF04-82BA-93AC06D5D739&deviceId=6896216935726017&anid=

                                      HTTP Response

                                      204

                                      HTTP Request

                                      GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=6c6abf2f91aa44979ef296072745a296&localId=w:F0FEBB8E-8133-CF04-82BA-93AC06D5D739&deviceId=6896216935726017&anid=

                                      HTTP Response

                                      204

                                      HTTP Request

                                      GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6c6abf2f91aa44979ef296072745a296&localId=w:F0FEBB8E-8133-CF04-82BA-93AC06D5D739&deviceId=6896216935726017&anid=

                                      HTTP Response

                                      204
                                    • 150.171.28.10:443
                                      tse1.mm.bing.net
                                      tls, http2
                                      1.2kB
                                       6.9kB
                                       15
                                      12
                                    • 150.171.28.10:443
                                      tse1.mm.bing.net
                                      tls, http2
                                      1.2kB
                                       6.9kB
                                       15
                                      12
                                    • 150.171.28.10:443
                                      tse1.mm.bing.net
                                      tls, http2
                                      1.2kB
                                       6.9kB
                                       15
                                      12
                                    • 150.171.28.10:443
                                      https://tse1.mm.bing.net/th?id=OADD2.10239360264303_1FV8HLP8B8WOIRSCV&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                                      tls, http2
                                      117.0kB
                                       3.4MB
                                       2497
                                      2489

                                      HTTP Request

                                      GET https://tse1.mm.bing.net/th?id=OADD2.10239360264291_1OMXAE3VFGJI9A76K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

                                      HTTP Request

                                      GET https://tse1.mm.bing.net/th?id=OADD2.10239340418607_15GIAV8TOK7UC4KMM&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

                                      HTTP Request

                                      GET https://tse1.mm.bing.net/th?id=OADD2.10239360125545_1ABMDCTEZ7ZJRMZDX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

                                      HTTP Request

                                      GET https://tse1.mm.bing.net/th?id=OADD2.10239360125544_1U4JKLLGDS2L5LDU8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

                                      HTTP Response

                                      200

                                      HTTP Response

                                      200

                                      HTTP Response

                                      200

                                      HTTP Response

                                      200

                                      HTTP Request

                                      GET https://tse1.mm.bing.net/th?id=OADD2.10239340418608_1Q6O2BHJAWL0R6QXX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

                                      HTTP Request

                                      GET https://tse1.mm.bing.net/th?id=OADD2.10239360264303_1FV8HLP8B8WOIRSCV&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

                                      HTTP Response

                                      200

                                      HTTP Response

                                      200
                                    • 150.171.28.10:443
                                      tse1.mm.bing.net
                                      tls, http2
                                      1.5kB
                                       6.9kB
                                       16
                                      13
                                    • 142.250.187.195:80
                                      http://c.pki.goog/r/r1.crl
                                      http
                                      384 B
                                       355 B
                                       4
                                      3

                                      HTTP Request

                                      GET http://c.pki.goog/r/r1.crl

                                      HTTP Response

                                      304
                                    • 8.8.8.8:53
                                      g.bing.com
                                      dns
                                      56 B
                                       148 B
                                       1
                                      1

                                      DNS Request

                                      g.bing.com

                                      DNS Response

                                      150.171.28.10
                                      150.171.27.10

                                    • 8.8.8.8:53
                                      tse1.mm.bing.net
                                      dns
                                      62 B
                                       170 B
                                       1
                                      1

                                      DNS Request

                                      tse1.mm.bing.net

                                      DNS Response

                                      150.171.28.10
                                      150.171.27.10

                                    • 8.8.8.8:53
                                      c.pki.goog
                                      dns
                                      56 B
                                       107 B
                                       1
                                      1

                                      DNS Request

                                      c.pki.goog

                                      DNS Response

                                      142.250.187.195

                                    MITRE ATT&CK Enterprise v15

                                    Reconnaissance

                                    Resource Development

                                    Initial Access

                                    Execution

                                    Persistence

                                    Create or Modify System Process

                                    1
                                    T1543

                                    Windows Service

                                    1
                                    T1543.003

                                    Pre-OS Boot

                                    1
                                    T1542

                                    Bootkit

                                    1
                                    T1542.003

                                    Privilege Escalation

                                    Abuse Elevation Control Mechanism

                                    1
                                    T1548

                                    Bypass User Account Control

                                    1
                                    T1548.002

                                    Create or Modify System Process

                                    1
                                    T1543

                                    Windows Service

                                    1
                                    T1543.003

                                    Defense Evasion

                                    Abuse Elevation Control Mechanism

                                    1
                                    T1548

                                    Bypass User Account Control

                                    1
                                    T1548.002

                                    Impair Defenses

                                    4
                                    T1562

                                    Disable or Modify System Firewall

                                    1
                                    T1562.004

                                    Disable or Modify Tools

                                    3
                                    T1562.001

                                    Modify Registry

                                    5
                                    T1112

                                    Pre-OS Boot

                                    1
                                    T1542

                                    Bootkit

                                    1
                                    T1542.003

                                    Credential Access

                                    Discovery

                                    System Information Discovery

                                    1
                                    T1082

                                    System Location Discovery

                                    1
                                    T1614

                                    System Language Discovery

                                    1
                                    T1614.001

                                    Lateral Movement

                                    Collection

                                    Command and Control

                                    Exfiltration

                                    Impact

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • memory/2216-0-0x0000000000400000-0x000000000071E000-memory.dmp

                                      Filesize

                                      3.1MB

                                      Download

                                    • memory/2216-1-0x0000000002640000-0x00000000036FA000-memory.dmp

                                      Filesize

                                      16.7MB

                                      Download

                                    • memory/2216-4-0x0000000002640000-0x00000000036FA000-memory.dmp

                                      Filesize

                                      16.7MB

                                      Download

                                    • memory/2216-3-0x0000000002640000-0x00000000036FA000-memory.dmp

                                      Filesize

                                      16.7MB

                                      Download

                                    • memory/2216-16-0x000000006E590000-0x000000006E5A0000-memory.dmp

                                      Filesize

                                      64KB

                                      Download

                                    • memory/2216-20-0x0000000002640000-0x00000000036FA000-memory.dmp

                                      Filesize

                                      16.7MB

                                      Download

                                    • memory/2216-9-0x0000000002640000-0x00000000036FA000-memory.dmp

                                      Filesize

                                      16.7MB

                                      Download

                                    • memory/2216-28-0x0000000000400000-0x000000000071E000-memory.dmp

                                      Filesize

                                      3.1MB

                                      Download

                                    • memory/2216-15-0x0000000002640000-0x00000000036FA000-memory.dmp

                                      Filesize

                                      16.7MB

                                      Download

                                    • memory/2216-18-0x0000000003D10000-0x0000000003D11000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/2216-17-0x0000000003D00000-0x0000000003D02000-memory.dmp

                                      Filesize

                                      8KB

                                      Download

                                    • memory/2216-5-0x0000000002640000-0x00000000036FA000-memory.dmp

                                      Filesize

                                      16.7MB

                                      Download

                                    We care about your privacy.

                                    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.