Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6402 | April 12, 2021, 10:39 a.m. | April 12, 2021, 10:41 a.m. |
-
-
wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\updateW\delete.vbs"
4936-
-
WMIC.exe wmic process where ExecutablePath='C:\\Windows (x86)\\explorer.exe' delete
3800 -
WMIC.exe wmic process where name='regedit.exe' delete
6892 -
WMIC.exe wmic process where name='taskhist.exe' delete
8084 -
WMIC.exe wmic process where name='taskIist.exe' delete
4884 -
taskkill.exe taskkill /f /im regedit.exe
9024 -
taskkill.exe taskkill /f /im taskhist.exe
8408 -
taskkill.exe taskkill /f /im taskIist.exe
4012 -
WMIC.exe wmic process where name='regedit.exe' delete
8140 -
WMIC.exe wmic process where name='taskhist.exe' delete
3080 -
WMIC.exe wmic process where name='taskIist.exe' delete
3264 -
taskkill.exe taskkill /f /im regedit.exe
4168 -
taskkill.exe taskkill /f /im taskhist.exe
8156 -
taskkill.exe taskkill /f /im taskIist.exe
6400 -
WMIC.exe wmic process where name='xmrig.exe' delete
3788 -
WMIC.exe wmic process where name='xmrig.exe' delete
7496 -
WMIC.exe wmic process where name='cmd.exe' delete
2300
-
-
-
Name | Response | Post-Analysis Lookup |
---|---|---|
No hosts contacted. |
IP Address | Status | Action |
---|---|---|
172.217.25.14 | Active | Moloch |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
pdb_path | D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb |
section | .gfids |
resource name | PNG |
file | C:\Users\test22\AppData\Local\Temp\updateW\delete.vbs |
file | C:\Users\test22\AppData\Local\Temp\updateW\delete.bat |
cmdline | wmic process where name='regedit.exe' delete |
cmdline | wmic process where name='taskIist.exe' delete |
cmdline | wmic process where ExecutablePath='C:\\Windows (x86)\\explorer.exe' delete |
cmdline | wmic process where name='xmrig.exe' delete |
cmdline | wmic process where name='taskhist.exe' delete |
cmdline | wmic process where name='cmd.exe' delete |
file | C:\Users\test22\AppData\Local\Temp\updateW\delete.vbs |
file | C:\Users\test22\AppData\Local\Temp\updateW\delete.bat |
wmi | SELECT * FROM Win32_Process WHERE name='cmd.exe' |
wmi | SELECT * FROM Win32_Process WHERE ExecutablePath='C:\\Windows (x86)\\explorer.exe' |
wmi | SELECT * FROM Win32_Process WHERE name='taskIist.exe' |
wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "taskIist.exe") |
wmi | SELECT * FROM Win32_Process WHERE name='taskhist.exe' |
wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "regedit.exe") |
wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "taskhist.exe") |
wmi | SELECT * FROM Win32_Process WHERE name='xmrig.exe' |
wmi | SELECT * FROM Win32_Process WHERE name='regedit.exe' |
description | Affect system registries | rule | win_registry | ||||||
description | Affect system token | rule | win_token | ||||||
description | Affect private profile | rule | win_private_profile | ||||||
description | Affect private profile | rule | win_files_operation | ||||||
description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
description | (no description) | rule | DebuggerHiding__Thread | ||||||
description | (no description) | rule | DebuggerHiding__Active | ||||||
description | (no description) | rule | ThreadControl__Context | ||||||
description | (no description) | rule | SEH__vectored | ||||||
description | Checks if being debugged | rule | anti_dbg | ||||||
description | Bypass DEP | rule | disable_dep |
cmdline | wmic process where name='regedit.exe' delete |
cmdline | wmic process where name='taskIist.exe' delete |
cmdline | taskkill /f /im regedit.exe |
cmdline | wmic process where ExecutablePath='C:\\Windows (x86)\\explorer.exe' delete |
cmdline | wmic process where name='xmrig.exe' delete |
cmdline | wmic process where name='taskhist.exe' delete |
cmdline | taskkill /f /im taskIist.exe |
cmdline | taskkill /f /im taskhist.exe |
cmdline | wmic process where name='cmd.exe' delete |
host | 172.217.25.14 |
cmdline | wmic process where name='xmrig.exe' delete |
parent_process | wscript.exe | martian_process | C:\Users\test22\AppData\Local\Temp\updateW\delete.bat | ||||||
parent_process | wscript.exe | martian_process | "C:\Users\test22\AppData\Local\Temp\updateW\delete.bat" |
file | C:\Windows\SysWOW64\wscript.exe |