Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6402 | May 4, 2021, 11:11 a.m. | May 4, 2021, 11:14 a.m. |
Name | Response | Post-Analysis Lookup |
---|---|---|
api.wipmania.com | 212.83.168.196 |
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
TCP 192.168.56.102:49807 -> 212.83.168.196:80 | 2014304 | ET POLICY External IP Lookup Attempt To Wipmania | Device Retrieving External IP Address Detected |
TCP 192.168.56.102:49809 -> 212.83.168.196:80 | 2014304 | ET POLICY External IP Lookup Attempt To Wipmania | Device Retrieving External IP Address Detected |
TCP 149.56.45.200:9030 -> 192.168.56.102:49812 | 2522180 | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 181 | Misc Attack |
Suricata TLS
No Suricata TLS
pdb_path |
packer | Armadillo v1.71 |
request | GET http://api.wipmania.com/ |
host | 149.56.45.200 | |||
host | 172.217.25.14 |
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services | reg_value | C:\11608722823373\lsass.exe | ||||||
reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services | reg_value | C:\11608722823373\lsass.exe |
registry | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride |
process | p.exe | useragent | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36 | ||||||
process | lsass.exe | useragent |
file | C:\11608722823373\lsass.exe:Zone.Identifier |
file | C:\Users\test22\AppData\Local\Temp\p.exe:Zone.Identifier |
description | attempts to disable antivirus notifications | registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride | ||||||
description | attempts to disable antivirus notifications | registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify | ||||||
description | attempts to disable firewall notifications | registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify | ||||||
description | attempts to disable firewall notifications | registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride | ||||||
description | attempts to disable windows update notifications | registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify |
Bkav | W32.AIDetect.malware2 |
Elastic | malicious (high confidence) |
MicroWorld-eScan | Dropped:Generic.Malware.SFYd.1047967C |
ALYac | Dropped:Generic.Malware.SFYd.1047967C |
Cylance | Unsafe |
Sangfor | Trojan.Win32.Save.a |
CrowdStrike | win/malicious_confidence_100% (W) |
Alibaba | Worm:Win32/Phorpiex.954d53a9 |
K7GW | Trojan ( 005533551 ) |
K7AntiVirus | Trojan ( 005533551 ) |
Arcabit | Generic.Malware.SFYd.DFFD9FC |
Symantec | ML.Attribute.HighConfidence |
ESET-NOD32 | a variant of Win32/Phorpiex.V |
APEX | Malicious |
Avast | Win32:CoinminerX-gen [Trj] |
ClamAV | Win.Malware.Zard-9793613-0 |
Kaspersky | HEUR:Trojan-Banker.Win32.ClipBanker.gen |
BitDefender | Dropped:Generic.Malware.SFYd.1047967C |
NANO-Antivirus | Trojan.Win32.ClipBanker.iusbkc |
Paloalto | generic.ml |
Ad-Aware | Dropped:Generic.Malware.SFYd.1047967C |
DrWeb | Win32.HLLW.Autoruner3.3323 |
McAfee-GW-Edition | BehavesLike.Win32.Dropper.ch |
FireEye | Generic.mg.ee0a1ec859b753ab |
Emsisoft | Dropped:Generic.Malware.SFYd.1047967C (B) |
Ikarus | Worm.Win32.Phorpiex |
Webroot | W32.Malware.Gen |
Avira | HEUR/AGEN.1132833 |
MAX | malware (ai score=100) |
Kingsoft | Win32.Heur.KVMH017.a.(kcloud) |
Microsoft | Trojan:Script/Phonzy.B!ml |
AegisLab | Trojan.Win32.ClipBanker.7!c |
GData | Dropped:Generic.Malware.SFYd.1047967C |
Cynet | Malicious (score: 100) |
AhnLab-V3 | Malware/Win.SFYd.C4442145 |
McAfee | RDN/Generic.tfr |
VBA32 | BScope.Trojan.Skeeyah |
Malwarebytes | Trojan.Phorpiex |
TrendMicro-HouseCall | TROJ_GEN.R06CC0WE321 |
Rising | Worm.Phorpiex!1.CA88 (CLOUD) |
SentinelOne | Static AI - Malicious PE |
Fortinet | W32/Phorpiex.V!worm |
BitDefenderTheta | Gen:NN.ZexaF.34686.guW@ae1FM0ki |
AVG | Win32:CoinminerX-gen [Trj] |
Cybereason | malicious.859b75 |