Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://trace-jp.med...

windows11-21h2-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    https://trace-jp.mediago.io/ju/ic?tn=41b6e88a2b85b0e731ef8e73e5558712&trackingid=b710f0207b24c4f5f08453bc56bef6d3&acid=30919&data=w2Txavf0WUHK2FQpYNZb8I6_h_bJUFeZcbrggAhsBUMFzesOkVbL1DuDet4NZ0dQ7Qgy6Pq91V_O_n8ZHztaNKEjfcgDyPiSXJmOQQh5BqBX_JMA7QCtNfqnP_KzsxXLQI1o8L6Isj_r6fCbtRt3bWe3tkGmEFqVKdMFF8dLeou4wD6pM-AVyyEIH1SwrWj5krN283SROhaBdX0C5W-p6iqYuZ6RYlTLqHRNaOTlVAVfCKCzhhYL8edWPDRH92gkdGH3-040I5vNNnQQxmMny_F9VokwUz249Htc5TbGZ-xvNz72XMo1guUTvyUu9Lng1TCv0cMmflvMjtMei_61byFtJtRZJArnQX0FlfcrdpaG8LaK-TfRvdvc604sph3EdtyqhQSrothfACkpx02qrIecSoK--b3k-H7kumJuY0zMLsrCYYfPIE82rhIQQ8Dd7Z22mxOMRT3QdFqAzO9YIL9MN4yFg3jIaM6J3lGD2puDmWkIX1HZIkt6hyV0ncVqY6NUNM6KtUZ2_oCWVZuxaUJ_X3XDpzQ9-jKdJYOFh4VrwVtYVhbDKQzaDLb4eL_fy6u0OOTS_sV6clmoE2qjtGKyfEOVbTmktOqAQmcAfFShiHq4g4r9s9IzzvSG9VZZuVYkyDnZs5dDimmsYn1KELkxawh3U59rqAonnICEVIklTFbE27xLcxIe-CvD7AwJqLhzB3cbFgWZMLd5WC7HWZxqo6KbpiRESjl0nhN_nByDafFPPo_SUsiAYnh1xg8U7fPfk41Qoy_XcEl2Clz-pH3F_MDZS08G8bkzc8oM-ueWXjQVK4QknUQL-DiPnBSzOtLSVK2g3qtD7uiX2wRfuRP-CFKc3yktdL7nVa9I58ar65FcvY6JHz2Ldlj0Td4jKhNTiqT47zrMksuVVRN9v9IuBFPNkzjgXWCc7R8uxGYKlIZSO2Stmd2-8vRXD3M3tQ9aRGhW9XPzhNIUyRcXq1Jz7-tcYzGHT25g5UTTfjyidpJQEu1KcJcUwVhUyZUp0Q0nw9s7dsEOlv_G8dPfgcbX4XhL8j9-sCRLDpzaT-k9oq90s82BToEyhLzkn3MZWHZbAwBkXL-HshC-j0dnQgOla8WdQiPc3vYE3KgIu1icdO2G2JYiPFnVSWycFlOtDJ_A1KVbTSYUSD-hwVD5pbY4M75a-gNBs59tBPAi2oHtCGNB-VZu6SJZziZC4edya6qke9VXe3cThCe421Ek27iJ0GjXITXRkaYoAqmLkM6D0vN5jWJex0l49_9oskH0vjc5az25P4UVMYOrtmyqDhbfHPTGIR7Rpg5HJhWPNoOvtgSTeL3xc2Erg3LxQIiL83w5yH3qzKH5JiZlf7qQwAafzmAycITfBQThd7EQG0Nf31kN-WBG7msStJixX1UTmfMfHvf-HgNtg9c9MWkK_D_io1MlbjnrEmXk4tTbctB_-mfjfnVNKtGlRVqrtUoPvzL2qxBHUedJdYoz-quzLysRHPSTUgReTN4Tdl9v9ZpqMGoRRf8H0qMt8GmOgf0itJRCx50-VAhsGBrDCQa23Yyh_kz7jc1TfBgfB9AYB9FAX1o2ucdCBpKyYR6Nxic7bYED0z57GJ1p7-DRBPp5IaQ-yzY66f9KlyaNCEQtbpwg09d_nCHpoSN2S0HYg3kTdcO0FAjyl_lCmXjVL8guR8lSQK93BvJg57ghLKYfJmSCbXdg22xrojfjQKk84zgubNM-m7tkL314J1F7vsx6MAXZ2gA2Dr-rmViMN8WBRRfwNGfUnzGZRDFfr7p2C8CheumUVfUZobF_VVa-AfNmQN7cNeNtsaZ_Vops1FtOazVmuFj_f91tKMmvjm_6GM2QWs8kLYBw1CpZl-Rf3eO0ueE7zOZ0Cmf4w3bXzERvzkxEroHKvxzs-l0HvAwp59mWaWcFep2nP_5VngTDUPzcS0Wvd0Vc8Ooz016vQvAdObe5_lJEaPcR0Ep5AMiKGaCqtdFLXOZ8_ZwY8C4y2YxrfoYL5dFv3zYsaDtClV8eaG27lxTP7gghfXk-oswbulQYN5C9qKsG4QpmRZf4yq0bPFBtSk9E8rWS5KeqWj6Wm8rrPv4TalOy1Hd7SoFCY88wNfDKUCekJIlZrQJ3oo--zgygh-HIZUxXzKseQnj1PC4vALyvMBXCVhJDz5-tnZSXFV72yJNzs_M_wLAJfT9o-QR3wnfXhbc9UPrUrE0Bxa4&uid=e8bf41cb-d13d-4c4d-86fe-00582f8a8b6a&mguid=&ap=0.172968&tid=72&gprice=7fjcD6H4duXJckKaw7LlDA09oTCj44McbRTd8zOijLY&campaignid=5219230&c_sync=1&google_click_url=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCDBk0trBJau60NO2Ok7QPrcy2sA6E2s79f-S-mIi1EcCNtwEQASD7m9VJYKWAgICYAcgBCeACAKgDAcgDAqoE_AJP0KgpwLj5HXL5bxSvs-dyqVJ-E88wRi99LwMU46VGJQv8OS00n1dwwAw0uJhaCTuwyNhtk0jAYU2BXD54W-oGHErYuhedGCqvnoOxQvElHt3MG3anBj-p-DgadHaHR3KKR6KTKmghO9sK1nb44-guOaMbKTfu3Oao7bL2-mnN8Hp2s3TxXQi2EnKKe5K7GzrIp4lqj3u5DDBdZkswL2AkDVD2ZD6wURfu45CovkYMNJ9MGoh7gSG4X7IHU4eX6GceE8bhdUXO_UkXzOdBlQ3MMnwugEJX2qhjKWsH7U0WQwnaU9ERiU91Zn0CLTKDHUQAM8GMt5CPg5_4cDFE6yXm5Cjbyfe48GesPi25qUtva4ntJyBy0FqNhHTR-2w8cpVdd8cWar6ikp_Ewzkiva12G-p6NDQkT2dc_ZmvveN1P4KMwQDaUNnvjwPQ35AaBIr3N893mN_5xb-BvDqsQBNSDGOdn0Vo4QYDqvprxU2gTMvZGHO7N7im5CcyiuAEAYAGtva0mpL3xuXnAaAGIagHk9ixAqgHlNixAqgHldixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQKoB62-sQKoB7_TsQLYBwDSCDcIjOGAQBABMgiLwoGOgICACDoUmtCAgICADJDAgICAoKiBAqiBgBBIvf3BOljF5MXlrrqVA2AA-gsCCAGADAGqDQJBVeINEwjFoMblrrqVAxVtx4QAHS2mDebqDRMI0uzG5a66lQMVbceEAB0tpg3miA7___________8B0BUBgBcBshcQGAwqCjIxODQzNjczNDZQAaoYFwmmm8QgBMwAQRIKMjE4NDM2NzM0NhgB%26num%3D1%26sig%3DAOD64_31Gb0_fI6Z7GJr9TMSzLsj_0Raxw%26client%3Dca-pub-5812357352335075%26adurl%3D
  • Sample260705-bpt4nsbx4j
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Targets

    • Target
      https://trace-jp.mediago.io/ju/ic?tn=41b6e88a2b85b0e731ef8e73e5558712&trackingid=b710f0207b24c4f5f08453bc56bef6d3&acid=30919&data=w2Txavf0WUHK2FQpYNZb8I6_h_bJUFeZcbrggAhsBUMFzesOkVbL1DuDet4NZ0dQ7Qgy6Pq91V_O_n8ZHztaNKEjfcgDyPiSXJmOQQh5BqBX_JMA7QCtNfqnP_KzsxXLQI1o8L6Isj_r6fCbtRt3bWe3tkGmEFqVKdMFF8dLeou4wD6pM-AVyyEIH1SwrWj5krN283SROhaBdX0C5W-p6iqYuZ6RYlTLqHRNaOTlVAVfCKCzhhYL8edWPDRH92gkdGH3-040I5vNNnQQxmMny_F9VokwUz249Htc5TbGZ-xvNz72XMo1guUTvyUu9Lng1TCv0cMmflvMjtMei_61byFtJtRZJArnQX0FlfcrdpaG8LaK-TfRvdvc604sph3EdtyqhQSrothfACkpx02qrIecSoK--b3k-H7kumJuY0zMLsrCYYfPIE82rhIQQ8Dd7Z22mxOMRT3QdFqAzO9YIL9MN4yFg3jIaM6J3lGD2puDmWkIX1HZIkt6hyV0ncVqY6NUNM6KtUZ2_oCWVZuxaUJ_X3XDpzQ9-jKdJYOFh4VrwVtYVhbDKQzaDLb4eL_fy6u0OOTS_sV6clmoE2qjtGKyfEOVbTmktOqAQmcAfFShiHq4g4r9s9IzzvSG9VZZuVYkyDnZs5dDimmsYn1KELkxawh3U59rqAonnICEVIklTFbE27xLcxIe-CvD7AwJqLhzB3cbFgWZMLd5WC7HWZxqo6KbpiRESjl0nhN_nByDafFPPo_SUsiAYnh1xg8U7fPfk41Qoy_XcEl2Clz-pH3F_MDZS08G8bkzc8oM-ueWXjQVK4QknUQL-DiPnBSzOtLSVK2g3qtD7uiX2wRfuRP-CFKc3yktdL7nVa9I58ar65FcvY6JHz2Ldlj0Td4jKhNTiqT47zrMksuVVRN9v9IuBFPNkzjgXWCc7R8uxGYKlIZSO2Stmd2-8vRXD3M3tQ9aRGhW9XPzhNIUyRcXq1Jz7-tcYzGHT25g5UTTfjyidpJQEu1KcJcUwVhUyZUp0Q0nw9s7dsEOlv_G8dPfgcbX4XhL8j9-sCRLDpzaT-k9oq90s82BToEyhLzkn3MZWHZbAwBkXL-HshC-j0dnQgOla8WdQiPc3vYE3KgIu1icdO2G2JYiPFnVSWycFlOtDJ_A1KVbTSYUSD-hwVD5pbY4M75a-gNBs59tBPAi2oHtCGNB-VZu6SJZziZC4edya6qke9VXe3cThCe421Ek27iJ0GjXITXRkaYoAqmLkM6D0vN5jWJex0l49_9oskH0vjc5az25P4UVMYOrtmyqDhbfHPTGIR7Rpg5HJhWPNoOvtgSTeL3xc2Erg3LxQIiL83w5yH3qzKH5JiZlf7qQwAafzmAycITfBQThd7EQG0Nf31kN-WBG7msStJixX1UTmfMfHvf-HgNtg9c9MWkK_D_io1MlbjnrEmXk4tTbctB_-mfjfnVNKtGlRVqrtUoPvzL2qxBHUedJdYoz-quzLysRHPSTUgReTN4Tdl9v9ZpqMGoRRf8H0qMt8GmOgf0itJRCx50-VAhsGBrDCQa23Yyh_kz7jc1TfBgfB9AYB9FAX1o2ucdCBpKyYR6Nxic7bYED0z57GJ1p7-DRBPp5IaQ-yzY66f9KlyaNCEQtbpwg09d_nCHpoSN2S0HYg3kTdcO0FAjyl_lCmXjVL8guR8lSQK93BvJg57ghLKYfJmSCbXdg22xrojfjQKk84zgubNM-m7tkL314J1F7vsx6MAXZ2gA2Dr-rmViMN8WBRRfwNGfUnzGZRDFfr7p2C8CheumUVfUZobF_VVa-AfNmQN7cNeNtsaZ_Vops1FtOazVmuFj_f91tKMmvjm_6GM2QWs8kLYBw1CpZl-Rf3eO0ueE7zOZ0Cmf4w3bXzERvzkxEroHKvxzs-l0HvAwp59mWaWcFep2nP_5VngTDUPzcS0Wvd0Vc8Ooz016vQvAdObe5_lJEaPcR0Ep5AMiKGaCqtdFLXOZ8_ZwY8C4y2YxrfoYL5dFv3zYsaDtClV8eaG27lxTP7gghfXk-oswbulQYN5C9qKsG4QpmRZf4yq0bPFBtSk9E8rWS5KeqWj6Wm8rrPv4TalOy1Hd7SoFCY88wNfDKUCekJIlZrQJ3oo--zgygh-HIZUxXzKseQnj1PC4vALyvMBXCVhJDz5-tnZSXFV72yJNzs_M_wLAJfT9o-QR3wnfXhbc9UPrUrE0Bxa4&uid=e8bf41cb-d13d-4c4d-86fe-00582f8a8b6a&mguid=&ap=0.172968&tid=72&gprice=7fjcD6H4duXJckKaw7LlDA09oTCj44McbRTd8zOijLY&campaignid=5219230&c_sync=1&google_click_url=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCDBk0trBJau60NO2Ok7QPrcy2sA6E2s79f-S-mIi1EcCNtwEQASD7m9VJYKWAgICYAcgBCeACAKgDAcgDAqoE_AJP0KgpwLj5HXL5bxSvs-dyqVJ-E88wRi99LwMU46VGJQv8OS00n1dwwAw0uJhaCTuwyNhtk0jAYU2BXD54W-oGHErYuhedGCqvnoOxQvElHt3MG3anBj-p-DgadHaHR3KKR6KTKmghO9sK1nb44-guOaMbKTfu3Oao7bL2-mnN8Hp2s3TxXQi2EnKKe5K7GzrIp4lqj3u5DDBdZkswL2AkDVD2ZD6wURfu45CovkYMNJ9MGoh7gSG4X7IHU4eX6GceE8bhdUXO_UkXzOdBlQ3MMnwugEJX2qhjKWsH7U0WQwnaU9ERiU91Zn0CLTKDHUQAM8GMt5CPg5_4cDFE6yXm5Cjbyfe48GesPi25qUtva4ntJyBy0FqNhHTR-2w8cpVdd8cWar6ikp_Ewzkiva12G-p6NDQkT2dc_ZmvveN1P4KMwQDaUNnvjwPQ35AaBIr3N893mN_5xb-BvDqsQBNSDGOdn0Vo4QYDqvprxU2gTMvZGHO7N7im5CcyiuAEAYAGtva0mpL3xuXnAaAGIagHk9ixAqgHlNixAqgHldixAqgHpr4bqAeW2BuoB6qbsQKoB_-esQKoB9-fsQKoB62-sQKoB7_TsQLYBwDSCDcIjOGAQBABMgiLwoGOgICACDoUmtCAgICADJDAgICAoKiBAqiBgBBIvf3BOljF5MXlrrqVA2AA-gsCCAGADAGqDQJBVeINEwjFoMblrrqVAxVtx4QAHS2mDebqDRMI0uzG5a66lQMVbceEAB0tpg3miA7___________8B0BUBgBcBshcQGAwqCjIxODQzNjczNDZQAaoYFwmmm8QgBMwAQRIKMjE4NDM2NzM0NhgB%26num%3D1%26sig%3DAOD64_31Gb0_fI6Z7GJr9TMSzLsj_0Raxw%26client%3Dca-pub-5812357352335075%26adurl%3D
    Score
    8/10
    defense_evasiondiscoverypersistenceransomware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Downloads MZ/PE file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks