Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6402 | June 24, 2021, 9 a.m. | June 24, 2021, 9:02 a.m. |
-
-
-
-
net1.exe C:\Windows\system32\net1 file
5980
-
-
WMIC.exe wmic LogicalDisk where (DriveType=2 And Access=0) get DeviceID
8948 -
cmd.exe C:\Windows\system32\cmd.exe /c type C:\Users\test22\AppData\Local\Temp\_drvltr.txt
7940 -
Wselect.exe Wselect C:\Users\test22\AppData\Local\Temp\_rdatmp.txt "Select a drive" "set usbDrive=$item" /oemlist
7816 -
Wbusy.exe wbusy "roda computer GmbH Creating Updatestick v2.15.8" "Abborted. No Stick selected" /stop
7112 -
PING.EXE ping localhost
6080
-
-
Name | Response | Post-Analysis Lookup |
---|---|---|
No hosts contacted. |
IP Address | Status | Action |
---|---|---|
172.217.25.14 | Active | Moloch |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
pdb_path | D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb |
section | .didat |
resource name | PNG |
file | C:\Users\test22\AppData\Local\Temp\updatestick\root\autorun.inf |
file | C:\Users\test22\AppData\Local\Temp\updatestick\Wprompt.exe |
file | C:\Users\test22\AppData\Local\Temp\updatestick\Wbusy.exe |
file | C:\Users\test22\AppData\Local\Temp\updatestick\root\LOCALE\MODE.COM |
file | C:\Users\test22\AppData\Local\Temp\updatestick\root\LOCALE\KEYB.EXE |
file | C:\Users\test22\AppData\Local\Temp\updatestick\Wselect.exe |
file | C:\Users\test22\AppData\Local\Temp\updatestick\syslinux.exe |
file | C:\Users\test22\AppData\Local\Temp\updatestick\root\LOCALE\DISPLAY.EXE |
file | C:\Users\test22\AppData\Local\Temp\updatestick\create.cmd |
cmdline | C:\Windows\system32\cmd.exe /c type C:\Users\test22\AppData\Local\Temp\_drvltr.txt |
cmdline | wmic LogicalDisk where (DriveType=2 And Access=0) get DeviceID |
file | C:\Users\test22\AppData\Local\Temp\updatestick\create.cmd |
file | C:\Users\test22\AppData\Local\Temp\updatestick\Wselect.exe |
file | C:\Users\test22\AppData\Local\Temp\updatestick\Wbusy.exe |
file | C:\Users\test22\AppData\Local\Temp\updatestick\Wselect.exe |
file | C:\Users\test22\AppData\Local\Temp\updatestick\Wbusy.exe |
file | C:\Users\test22\AppData\Local\Temp\updatestick\Wprompt.exe |
file | C:\Users\test22\AppData\Local\Temp\updatestick\syslinux.exe |
wmi | SELECT DeviceID FROM Win32_LogicalDisk WHERE (DriveType=2 And Access=0) |
cmdline | wmic LogicalDisk where (DriveType=2 And Access=0) get DeviceID |
cmdline | ping localhost |
cmdline | net file |
wmi | SELECT DeviceID FROM Win32_LogicalDisk WHERE (DriveType=2 And Access=0) |
host | 172.217.25.14 |
file | C:\Users\test22\AppData\Local\Temp\updatestick\root\EFI\BOOT\Bootx64.efi |
file | C:\Users\test22\AppData\Local\Temp\updatestick\root\EFI\BOOT\Shell.efi |
file | C:\Users\test22\AppData\Local\Temp\updatestick\root\LOCALE\KEYB.EXE |
file | C:\Users\test22\AppData\Local\Temp\updatestick\root\LOCALE\DISPLAY.EXE |
file | C:\Users\test22\AppData\Local\Temp\updatestick\create.cmd |
Bkav | W32.AIDetect.malware2 |
Cybereason | malicious.e8fcd9 |
Cyren | Expiro |
ClamAV | Win.Trojan.Darkkomet-9861273-0 |
Paloalto | generic.ml |
APEX | Malicious |
Rising | Trojan.Generic@ML.84 (RDML:IlirgeBswjqEG2KxIgU7yw) |
Emsisoft | Trojan.Agent (A) |
McAfee-GW-Edition | BehavesLike.Win32.Generic.tc |
Antiy-AVL | Trojan/Generic.ASMalwS.984D16 |
Microsoft | Trojan:Win32/Zpevdo.B |
Cynet | Malicious (score: 100) |
McAfee | Artemis!BDAF8A45432E |