General

  • Target
    https://lg-zhr.914trk.com/ck.php?oaparams=2__bannerid=276604__zoneid=8404__OXLCA=1__cb=a315oc6c59__x_udomain=bing.com__x_pid3=na__vtag=K:1;F:0;D:buffalowildwings.com;P:4b06b1;I:6a61233d-0dc7-f4ad-8880-d48c5ad40af9;R:u;H:backendrtbprimary7f697858986h2h6;T:75;__z=dgH4RLgHdmfzyBQxRooCgJqLYky59RLE0zTSCvrBaEoH2IRxyXzEwWdPt6KfLrmngiHzo7giH40aGkTV3k__req.clickid=SELO-TBMP0y6u_EyMZS8MX-0rRw___reqDestUrl=http%3A%2F%2Fwww.buffalowildwings.com%2Flocations%2Fus%2Fil%2Fwaukegan%2F3961-fountain-square-place%2Fstore-161__oadest=https%3A%2F%2Fplaywithonetap.com%2Findex%3Fcid%3D3fa5017d7a964ede85bf86b0914de156%26extclickid%3D6a61233d-0dc7-f4ad-8880-d48c5ad40af9%26cost%3D0.05%26t1%3Ds2599879d2841979%26t2%3D390408%26type%3Ddefault%26traffic_type%3D15%26random%3Da315oc6c59%26oadest%3Dhttp%253A%252F%252Fwww.buffalowildwings.com%252Flocations%252Fus%252Fil%252Fwaukegan%252F3961-fountain-square-place%252Fstore-161
  • Sample260723-t3cqnasgla
Score
7/10

Malware Config

Targets

    • Target
      https://lg-zhr.914trk.com/ck.php?oaparams=2__bannerid=276604__zoneid=8404__OXLCA=1__cb=a315oc6c59__x_udomain=bing.com__x_pid3=na__vtag=K:1;F:0;D:buffalowildwings.com;P:4b06b1;I:6a61233d-0dc7-f4ad-8880-d48c5ad40af9;R:u;H:backendrtbprimary7f697858986h2h6;T:75;__z=dgH4RLgHdmfzyBQxRooCgJqLYky59RLE0zTSCvrBaEoH2IRxyXzEwWdPt6KfLrmngiHzo7giH40aGkTV3k__req.clickid=SELO-TBMP0y6u_EyMZS8MX-0rRw___reqDestUrl=http%3A%2F%2Fwww.buffalowildwings.com%2Flocations%2Fus%2Fil%2Fwaukegan%2F3961-fountain-square-place%2Fstore-161__oadest=https%3A%2F%2Fplaywithonetap.com%2Findex%3Fcid%3D3fa5017d7a964ede85bf86b0914de156%26extclickid%3D6a61233d-0dc7-f4ad-8880-d48c5ad40af9%26cost%3D0.05%26t1%3Ds2599879d2841979%26t2%3D390408%26type%3Ddefault%26traffic_type%3D15%26random%3Da315oc6c59%26oadest%3Dhttp%253A%252F%252Fwww.buffalowildwings.com%252Flocations%252Fus%252Fil%252Fwaukegan%252F3961-fountain-square-place%252Fstore-161
    Score
    7/10
    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

MITRE ATT&CK Enterprise v16

Tasks