Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | Feb. 19, 2024, 7:49 a.m. | Feb. 19, 2024, 7:54 a.m. |
-
-
schtasks.exe schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
2680 -
schtasks.exe schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
2764 -
jlzfI3MOMBv1vbp25nBj.exe "C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\jlzfI3MOMBv1vbp25nBj.exe"
2936-
-
iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2988 CREDAT:145409
3064
-
-
-
schtasks.exe schtasks /create /f /RU "test22" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 HR" /sc HOURLY /rl HIGHEST
2516 -
schtasks.exe schtasks /create /f /RU "test22" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 LG" /sc ONLOGON /rl HIGHEST
2580 -
cHXwqlMWUMGBBwN9hxfj.exe "C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\cHXwqlMWUMGBBwN9hxfj.exe"
2704 -
y3p6n3ne22r3BFOUsYqb.exe "C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\y3p6n3ne22r3BFOUsYqb.exe"
1576 -
a77VWg3R2bV_Qy103LSX.exe "C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\a77VWg3R2bV_Qy103LSX.exe"
2056 -
PDbNNj6OmrILaV3JtHH1.exe "C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\PDbNNj6OmrILaV3JtHH1.exe"
2932
-
-
explorer.exe C:\Windows\Explorer.EXE
1452
Name | Response | Post-Analysis Lookup |
---|---|---|
ssl.gstatic.com | 172.217.25.163 | |
accounts.google.com | 64.233.188.84 | |
ipinfo.io | 34.117.186.192 | |
www.google.com | 142.250.206.228 | |
db-ip.com | 104.26.4.15 |
Suricata Alerts
Suricata TLS
Flow | Issuer | Subject | Fingerprint |
---|---|---|---|
TLSv1 192.168.56.101:49168 172.67.75.166:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 03:f8:79:dd:26:16:32:12:a4:33:99:34:af:f7:33:32:d5:e0:aa:e5 |
TLSv1 192.168.56.101:49182 64.233.188.84:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 | CN=accounts.google.com | 22:f1:10:1f:49:c5:97:f4:85:76:5a:20:dd:85:7c:ff:e2:c9:2a:1f |
TLSv1 192.168.56.101:49183 64.233.188.84:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 | CN=accounts.google.com | 22:f1:10:1f:49:c5:97:f4:85:76:5a:20:dd:85:7c:ff:e2:c9:2a:1f |
TLSv1 192.168.56.101:49185 216.58.200.227:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 | CN=*.gstatic.com | f1:41:dd:4f:a6:9f:7b:ae:ae:af:78:bd:08:f8:c8:40:3c:c4:8c:93 |
TLSv1 192.168.56.101:49193 172.217.25.4:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 | CN=www.google.com | 2a:14:a8:9a:ea:5b:44:20:c3:ae:90:ff:4d:2f:4c:22:15:54:f9:7c |
TLSv1 192.168.56.101:49184 216.58.200.227:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 | CN=*.gstatic.com | f1:41:dd:4f:a6:9f:7b:ae:ae:af:78:bd:08:f8:c8:40:3c:c4:8c:93 |
TLSv1 192.168.56.101:49208 172.67.75.166:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 03:f8:79:dd:26:16:32:12:a4:33:99:34:af:f7:33:32:d5:e0:aa:e5 |
TLSv1 192.168.56.101:49209 172.67.75.166:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc RSA CA-2 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com | 03:f8:79:dd:26:16:32:12:a4:33:99:34:af:f7:33:32:d5:e0:aa:e5 |
TLSv1 192.168.56.101:49192 172.217.25.4:443 |
C=US, O=Google Trust Services LLC, CN=GTS CA 1C3 | CN=www.google.com | 2a:14:a8:9a:ea:5b:44:20:c3:ae:90:ff:4d:2f:4c:22:15:54:f9:7c |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome |
section |
suspicious_features | Connection to IP address | suspicious_request | HEAD http://185.215.113.46/cost/fu.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://185.215.113.46/cost/fu.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://185.215.113.46/mine/amert.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://185.215.113.46/mine/amert.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://185.215.113.46/cost/niks.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://185.215.113.46/cost/niks.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://185.215.113.46/mine/plaza.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://185.215.113.46/mine/plaza.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | HEAD http://185.215.113.46/cost/ladas.exe | ||||||
suspicious_features | Connection to IP address | suspicious_request | GET http://185.215.113.46/cost/ladas.exe |
request | HEAD http://185.215.113.46/cost/fu.exe |
request | GET http://185.215.113.46/cost/fu.exe |
request | HEAD http://185.215.113.46/mine/amert.exe |
request | GET http://185.215.113.46/mine/amert.exe |
request | HEAD http://185.215.113.46/cost/niks.exe |
request | GET http://185.215.113.46/cost/niks.exe |
request | HEAD http://185.215.113.46/mine/plaza.exe |
request | GET http://185.215.113.46/mine/plaza.exe |
request | HEAD http://185.215.113.46/cost/ladas.exe |
request | GET http://185.215.113.46/cost/ladas.exe |
request | GET http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml |
request | GET https://db-ip.com/demo/home.php?s=175.208.134.152 |
request | GET https://accounts.google.com/ |
request | GET https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F |
request | GET https://accounts.google.com/InteractiveLogin?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&ifkv=ATuJsjzgUHm32IHHReMnNubjaHuhhXLWhS_SbL3pzJaoM1SttxKeFUH3DHO_0ehIkDGeccM5wp6izw |
request | GET https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F&ifkv=ATuJsjyDRmcM1-iZW3cVP-5MNSZnEdXkJZwAmQw8bVgZ0PLSvIIrqtM1U1kcweY3onol0wRoljOR_w&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S-117171857%3A1708296749375638 |
request | GET https://accounts.google.com/_/bscframe |
request | GET https://ssl.gstatic.com/images/branding/googlelogo/2x/googlelogo_color_74x24dp.png |
request | GET https://accounts.google.com/favicon.ico |
request | GET https://accounts.google.com/generate_204?EE92yg |
request | GET https://www.google.com/favicon.ico |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Local Extension Settings\lpilbniiabackdjcionkobglmddfbcjo\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\Sync Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Sync Extension Settings\mgffkfbidihjpoaomajlbgchddlicgpn\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Sync Extension Settings\lpilbniiabackdjcionkobglmddfbcjo\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Sync Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Sync Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\Sync Extension Settings\jnkelfanjkeadonecabehalmbgpfodjm\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\Sync Extension Settings\jnkelfanjkeadonecabehalmbgpfodjm\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Local Extension Settings\gjagmgiddbbciopjhllkdnddhcglnemk\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\FileTypePolicies\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Sync Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateRevocation\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\Sync Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter\Sync Extension Settings\cjmkndjhnagcfbpiemnkdpomccnjblmj\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Sync Extension Settings\oeljdldpnmdbchonielidgobddffflal\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Sync Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\Sync Extension Settings\flpiciilemghbmfalicajoolhkkenfel\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\SwReporter\Local Extension Settings\aijcbedoijmgnlmjeegjaglmepbmpkpi\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.ldb |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\ShaderCache\Sync Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\OriginTrials\Sync Extension Settings\fhilaheimglignddkjgofkcbgekhenbh\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Local Extension Settings\gojhcdgcpbpfigcaejpfhfegekdgiblk\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\CertificateTransparency\Sync Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\Sync Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\PepperFlash\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\pnacl\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kkpllkodjeloidieedojogacfhpaihoh\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\Sync Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Safe Browsing\Sync Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Sync Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Crashpad\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\BrowserMetrics\Sync Extension Settings\kkpllkodjeloidieedojogacfhpaihoh\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\WidevineCdm\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local Extension Settings\kmhcihpebfmpgmihbkipmjlmmioameka\CURRENT |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Subresource Filter\Sync Extension Settings\hcflpincpppdclinealmandijcmnkbgn\CURRENT |
domain | ipinfo.io |
file | C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\a77VWg3R2bV_Qy103LSX.exe |
file | C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\PDbNNj6OmrILaV3JtHH1.exe |
file | C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\y3p6n3ne22r3BFOUsYqb.exe |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS131.lnk |
file | C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\cHXwqlMWUMGBBwN9hxfj.exe |
file | C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\jlzfI3MOMBv1vbp25nBj.exe |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS131.lnk |
cmdline | schtasks /create /f /RU "test22" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 LG" /sc ONLOGON /rl HIGHEST |
cmdline | schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST |
cmdline | schtasks /create /f /RU "test22" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST |
cmdline | schtasks /create /f /RU "test22" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 HR" /sc HOURLY /rl HIGHEST |
file | C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\jlzfI3MOMBv1vbp25nBj.exe |
file | C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\y3p6n3ne22r3BFOUsYqb.exe |
file | C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\a77VWg3R2bV_Qy103LSX.exe |
file | C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\PDbNNj6OmrILaV3JtHH1.exe |
file | C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\a77VWg3R2bV_Qy103LSX.exe |
file | C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\jlzfI3MOMBv1vbp25nBj.exe |
file | C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\y3p6n3ne22r3BFOUsYqb.exe |
file | C:\Users\test22\AppData\Local\Temp\heidiuMNHkTdTYfan\PDbNNj6OmrILaV3JtHH1.exe |
file | C:\Users\test22\AppData\Local\Temp\00c07260dc\explorgu.exe |