winapi32.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6403_us | Nov. 10, 2021, 8:18 a.m. | Nov. 10, 2021, 8:27 a.m. |
-
-
cmd.exe C:\Windows\system32\cmd.exe /c icacls "C:\Users\test22\AppData\Roaming\Mxmetamux" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)" & icacls "C:\Users\test22\AppData\Roaming\Mxmetamux" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)" & icacls "C:\Users\test22\AppData\Roaming\Mxmetamux" /inheritance:e /deny "test22:(R,REA,RA,RD)"
2452-
icacls.exe icacls "C:\Users\test22\AppData\Roaming\Mxmetamux" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)"
2564 -
icacls.exe icacls "C:\Users\test22\AppData\Roaming\Mxmetamux" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)"
2612 -
icacls.exe icacls "C:\Users\test22\AppData\Roaming\Mxmetamux" /inheritance:e /deny "test22:(R,REA,RA,RD)"
2660
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| iplogger.org | 88.99.66.31 |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.103:49166 -> 88.99.66.31:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLSv1 192.168.56.103:49166 88.99.66.31:443 |
C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA | CN=*.iplogger.org | 55:1e:13:99:46:1c:67:40:a3:48:7f:38:0d:16:e7:51:f4:c4:43:cb |
| request | GET https://iplogger.org/1hkvy7 |
| cmdline | C:\Windows\system32\cmd.exe /c icacls "C:\Users\test22\AppData\Roaming\Mxmetamux" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)" & icacls "C:\Users\test22\AppData\Roaming\Mxmetamux" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)" & icacls "C:\Users\test22\AppData\Roaming\Mxmetamux" /inheritance:e /deny "test22:(R,REA,RA,RD)" |
| section | {u'size_of_data': u'0x00056400', u'virtual_address': u'0x0012e000', u'entropy': 7.93583975595991, u'name': u'UPX1', u'virtual_size': u'0x00057000'} | entropy | 7.93583975596 | description | A section with a high entropy has been found | |||||||||
| entropy | 0.334951456311 | description | Overall entropy of this PE file is high | |||||||||||
| section | UPX0 | description | Section name indicates UPX | ||||||
| section | UPX1 | description | Section name indicates UPX | ||||||
| cmdline | icacls "C:\Users\test22\AppData\Roaming\Mxmetamux" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)" |
| cmdline | icacls "C:\Users\test22\AppData\Roaming\Mxmetamux" /inheritance:e /deny "test22:(R,REA,RA,RD)" |
| cmdline | C:\Windows\system32\cmd.exe /c icacls "C:\Users\test22\AppData\Roaming\Mxmetamux" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)" & icacls "C:\Users\test22\AppData\Roaming\Mxmetamux" /inheritance:e /deny "*S-1-5-7:(R,REA,RA,RD)" & icacls "C:\Users\test22\AppData\Roaming\Mxmetamux" /inheritance:e /deny "test22:(R,REA,RA,RD)" |
| cmdline | icacls "C:\Users\test22\AppData\Roaming\Mxmetamux" /inheritance:e /deny "*S-1-1-0:(R,REA,RA,RD)" |
| Bkav | W32.AIDetect.malware2 |
| Elastic | malicious (high confidence) |
| MicroWorld-eScan | Trojan.GenericKD.47342425 |
| FireEye | Trojan.GenericKD.47342425 |
| ALYac | Trojan.GenericKD.47342425 |
| Cylance | Unsafe |
| Alibaba | Trojan:Win32/Starter.ali2000005 |
| Arcabit | Trojan.Generic.D2D26359 |
| Cyren | W32/Nymeria.E.gen!Eldorado |
| Symantec | ML.Attribute.HighConfidence |
| ESET-NOD32 | a variant of Generik.MNNMTCX |
| APEX | Malicious |
| Paloalto | generic.ml |
| Kaspersky | Trojan.Win32.Bingoml.cqiq |
| BitDefender | Trojan.GenericKD.47342425 |
| Avast | Win32:Malware-gen |
| Ad-Aware | Trojan.GenericKD.47342425 |
| Sophos | Mal/Generic-S |
| DrWeb | Trojan.Siggen15.35763 |
| TrendMicro | TrojanSpy.Win32.BINGOML.USMANK721 |
| McAfee-GW-Edition | BehavesLike.Win32.Generic.tc |
| Emsisoft | Trojan.GenericKD.47342425 (B) |
| Avira | TR/Redcap.oibly |
| Gridinsoft | Ransom.Win32.Sabsik.sa |
| Microsoft | Trojan:Win32/Sabsik.FL.B!ml |
| GData | Win32.Trojan.QuilMiner.46SS8S |
| Cynet | Malicious (score: 100) |
| AhnLab-V3 | Trojan/Win.Generic.C4762557 |
| McAfee | Artemis!5F20B46E52C4 |
| MAX | malware (ai score=84) |
| Malwarebytes | Trojan.MalPack |
| Zoner | Trojan.Win32.79630 |
| TrendMicro-HouseCall | TrojanSpy.Win32.BINGOML.USMANK721 |
| Ikarus | Trojan.SuspectCRC |
| MaxSecure | Trojan.Malware.300983.susgen |
| Fortinet | W32/PossibleThreat |
| AVG | Win32:Malware-gen |
| Panda | Trj/CI.A |
| CrowdStrike | win/malicious_confidence_70% (W) |