Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6402 | July 14, 2021, 4:50 p.m. | July 14, 2021, 4:55 p.m. |
Name | Response | Post-Analysis Lookup |
---|---|---|
adminserver.xyz | 172.67.151.89 |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
file | C:\Program Files (x86)\Google\Chrome\Application\chrome.exe |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox |
section | CODE |
section | DATA |
section | BSS |
suspicious_features | POST method with no referer header, HTTP version 1.0 used | suspicious_request | POST http://adminserver.xyz/Bn4/fre.php |
request | POST http://adminserver.xyz/Bn4/fre.php |
request | POST http://adminserver.xyz/Bn4/fre.php |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\101.3.34.11\ChromeRecovery.exe |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Roaming\Opera\Opera Next\data\Login Data |
file | C:\Users\test22\AppData\Local\Chromium\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data |
file | C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Default\Login Data |
file | C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data |
file | C:\Users\test22\AppData\LocalMapleStudio\ChromePlus\Login Data |
file | C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Local\Nichrome\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Local\RockMelt\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox |
file | C:\Program Files (x86)\Mozilla Thunderbird\pingsender.exe |
file | C:\Program Files (x86)\Hnc\HncUtils\HncUpdate.exe |
file | C:\Program Files (x86)\Mozilla Thunderbird\plugin-container.exe |
file | C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe |
file | C:\Program Files (x86)\Java\jre1.8.0_131\bin\javaw.exe |
file | C:\Python27\Lib\site-packages\setuptools\cli-32.exe |
file | C:\Program Files (x86)\Java\jre1.8.0_131\bin\ssvagent.exe |
file | C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe |
file | C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleUpdateBroker.exe |
file | C:\Program Files (x86)\Microsoft Office\Office14\1042\ONELEV.EXE |
file | C:\Python27\Scripts\easy_install.exe |
file | C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE |
file | C:\MSOCache\All Users\{90140000-006E-0412-0000-0000000FF1CE}-C\dwtrig20.exe |
file | C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE |
file | C:\Program Files (x86)\Common Files\microsoft shared\IME14\SHARED\IMEPADSV.EXE |
file | C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE |
file | C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE |
file | C:\Python27\Lib\site-packages\pip\_vendor\distlib\w32.exe |
file | C:\Program Files (x86)\7-Zip\7z.exe |
file | C:\Program Files (x86)\Hnc\Common80\HimTrayIcon.exe |
file | C:\Program Files (x86)\Java\jre1.8.0_131\bin\unpack200.exe |
file | C:\Program Files (x86)\Hnc\Hwp80\HwpFinder.exe |
file | C:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.36.82\GoogleUpdateSetup.exe |
file | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe |
file | C:\Program Files (x86)\EditPlus\editplus.exe |
file | C:\Python27\Lib\site-packages\pip\_vendor\distlib\t64.exe |
file | C:\Program Files (x86)\Hnc\Hwp80\HwpPrnMng.exe |
file | C:\Python27\Lib\site-packages\pip\_vendor\distlib\t32.exe |
file | C:\Program Files (x86)\Google\Chrome\Application\chrome_proxy.exe |
file | C:\Program Files (x86)\Mozilla Thunderbird\maintenanceservice.exe |
file | C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE |
file | C:\Program Files (x86)\Mozilla Thunderbird\minidump-analyzer.exe |
file | C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE |
file | C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE |
file | C:\Program Files (x86)\Mozilla Thunderbird\crashreporter.exe |
file | C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe |
file | C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleCrashHandler.exe |
file | C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleUpdateCore.exe |
file | C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE |
file | C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe |
file | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe |
file | C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE |
file | C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Setup.exe |
file | C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE |
file | C:\Program Files (x86)\Hnc\Common80\HncReporter.exe |
file | C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE |
file | C:\Program Files (x86)\7-Zip\7zFM.exe |
file | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
file | C:\Program Files (x86)\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE |
file | C:\Program Files (x86)\Common Files\microsoft shared\IME14\SHARED\IMECFMUI.EXE |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\101.3.34.11\ChromeRecovery.exe |
file | C:\Users\test22\AppData\Local\Temp\sklqynsm.dll |
url | http://www.ibsensoftware.com/ |
description | Communications use DNS | rule | Network_DNS | ||||||
description | Win32 PWS Loki | rule | Win32_PWS_Loki_Zero | ||||||
description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
description | (no description) | rule | DebuggerHiding__Thread | ||||||
description | (no description) | rule | DebuggerHiding__Active | ||||||
description | (no description) | rule | ThreadControl__Context | ||||||
description | (no description) | rule | SEH__vectored | ||||||
description | Checks if being debugged | rule | anti_dbg | ||||||
description | Bypass DEP | rule | disable_dep |
reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default) | reg_value | C:\Windows\svchost.com "%1" %* |
file | C:\Program Files (x86)\FTPGetter\Profile\servers.xml |
file | C:\Users\test22\AppData\Roaming\FTPGetter\servers.xml |
file | C:\Users\test22\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat |
file | C:\Users\test22\AppData\Roaming\GHISLER\wcx_ftp.ini |
file | C:\Users\test22\AppData\Roaming\wcx_ftp.ini |
file | C:\Windows\wcx_ftp.ini |
file | C:\Users\test22\wcx_ftp.ini |
file | C:\Windows\32BitFtp.ini |
file | C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml |
file | C:\Program Files (x86)\FileZilla\Filezilla.xml |
file | C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml |
file | C:\Users\test22\AppData\Roaming\FileZilla\filezilla.xml |
registry | HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts |
registry | HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts |
registry | HKEY_CURRENT_USER\Software\Ghisler\Total Commander |
registry | HKEY_CURRENT_USER\Software\VanDyke\SecureFX |
registry | HKEY_CURRENT_USER\Software\LinasFTP\Site Manager |
registry | HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings |
registry | HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions |
registry | HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions |
registry | HKEY_CURRENT_USER\Software\Martin Prikryl |
registry | HKEY_LOCAL_MACHINE\Software\Martin Prikryl |
file | C:\Users\test22\AppData\Roaming\.purple\accounts.xml |
file | C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini |
registry | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird\78.4.0 (ko)\Main |
registry | HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook |
Bkav | W32.NeshtaB.PE |
Elastic | malicious (high confidence) |
Cynet | Malicious (score: 100) |
FireEye | Generic.mg.7cb96438c874f472 |
CAT-QuickHeal | W32.Neshta.C8 |
McAfee | W32/HLLP.41472.e |
Cylance | Unsafe |
Zillya | Virus.Neshta.Win32.1 |
Sangfor | Win.Trojan.Neshuta-1 |
K7AntiVirus | Virus ( 00556e571 ) |
K7GW | Virus ( 00556e571 ) |
CrowdStrike | win/malicious_confidence_100% (D) |
Baidu | Win32.Virus.Neshta.a |
Cyren | W32/Neshta.OBIX-2981 |
Symantec | W32.Neshuta |
ESET-NOD32 | Win32/Neshta.A |
APEX | Malicious |
ClamAV | Win.Trojan.Neshuta-1 |
Kaspersky | Virus.Win32.Neshta.a |
BitDefender | Win32.Neshta.A |
NANO-Antivirus | Trojan.Win32.Winlock.fmobyw |
MicroWorld-eScan | Win32.Neshta.A |
Avast | Win32:Apanas [Trj] |
Rising | Win32.Neshta.a (CLASSIC) |
Ad-Aware | Win32.Neshta.A |
Sophos | ML/PE-A + W32/Neshta-D |
Comodo | Win32.Neshta.A@3ypg |
DrWeb | Win32.HLLP.Neshta |
VIPRE | Virus.Win32.Neshta.a (v) |
TrendMicro | PE_NESHTA.A |
McAfee-GW-Edition | BehavesLike.Win32.HLLP.cc |
Emsisoft | Win32.Neshta.A (B) |
SentinelOne | Static AI - Malicious PE |
Jiangmin | Virus.Neshta.a |
Avira | W32/Neshta.A |
Antiy-AVL | Trojan/Generic.ASVirus.20D |
Microsoft | Virus:Win32/Neshta.A |
Gridinsoft | Virus.Neshta.A.sd!yf |
ViRobot | Win32.Neshta.Gen.A |
GData | Win32.Virus.Neshta.D |
TACHYON | Virus/W32.Neshta |
AhnLab-V3 | Win32/Neshta |
Acronis | suspicious |
BitDefenderTheta | AI:FileInfector.D5C3B0640E |
ALYac | Win32.Neshta.A |
MAX | malware (ai score=81) |
VBA32 | Virus.Win32.Neshta.a |
Malwarebytes | Neshta.Virus.FileInfector.DDS |
Zoner | Virus.Win32.19514 |
TrendMicro-HouseCall | PE_NESHTA.A |