BIO.dotm| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6402 | Aug. 3, 2021, 2:13 p.m. | Aug. 3, 2021, 2:15 p.m. |
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| zenma.getenjoyment.net | 185.176.43.106 |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 185.176.43.106:80 -> 192.168.56.102:49166 | 2026989 | ET INFO PowerShell Hidden Window Command Common In Powershell Stagers M1 | A Network Trojan was detected |
| TCP 185.176.43.106:80 -> 192.168.56.102:49166 | 2026995 | ET INFO PowerShell DownloadString Command Common In Powershell Stagers | A Network Trojan was detected |
Suricata TLS
No Suricata TLS
| suspicious_features | GET method with no useragent header | suspicious_request | GET http://zenma.getenjoyment.net/ja/ng.txt | ||||||
| suspicious_features | POST method with no referer header, POST method with no useragent header | suspicious_request | POST http://zenma.getenjoyment.net/ja/post.php | ||||||
| request | GET http://zenma.getenjoyment.net/ja/ng.txt |
| request | POST http://zenma.getenjoyment.net/ja/post.php |
| request | POST http://zenma.getenjoyment.net/ja/post.php |
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||