Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | June 9, 2024, 9:10 a.m. | June 9, 2024, 9:17 a.m. |
-
-
-
svchost.exe "C:\Users\test22\AppData\Local\Temp\proposal%20report.exe"
2696
-
-
-
-
firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
2080
-
-
explorer.exe C:\Windows\Explorer.EXE
1452
IP Address | Status | Action |
---|---|---|
116.50.37.244 | Active | Moloch |
154.215.72.110 | Active | Moloch |
164.124.101.2 | Active | Moloch |
195.110.124.133 | Active | Moloch |
202.172.28.202 | Active | Moloch |
45.33.6.223 | Active | Moloch |
46.30.213.191 | Active | Moloch |
66.29.149.46 | Active | Moloch |
85.159.66.93 | Active | Moloch |
91.195.240.94 | Active | Moloch |
Suricata Alerts
Suricata TLS
No Suricata TLS
request | POST http://www.3xfootball.com/fo8o/ |
request | GET http://www.3xfootball.com/fo8o/?mRfW=IhZyPQIGe6uK3zPwwQVGm4hCASyaX3xlW2eS79Xk6ut4afzj0LiRHBqZsEmyTx+18GfGhVOagMos+c9dx/PGjLGAfpOvJ7U3hUqpnKd0zHv/hQdGhX4G3JlCydyJ23yerjxn4r8=&SM4k=DX6TxPgI |
request | GET http://www.sqlite.org/2021/sqlite-dll-win32-x86-3340000.zip |
request | GET http://www.sqlite.org/2020/sqlite-dll-win32-x86-3310000.zip |
request | POST http://www.kasegitai.tokyo/fo8o/ |
request | GET http://www.kasegitai.tokyo/fo8o/?mRfW=0LNqIGaAWMhMIMLOr1FzuAu+QFTp+Isr9lFre+yu3/9GvRNYi1uHghhDsQ/pqDAQ+wkUrFUIurr7TLyDqzId9vCn3h40hICDSYZjejM1bTxHHnFMxARLyMCZMUhSp6GMEGHL0HI=&SM4k=DX6TxPgI |
request | POST http://www.goldenjade-travel.com/fo8o/ |
request | GET http://www.goldenjade-travel.com/fo8o/?mRfW=LFKqyrcu7g1NCa8bIVnmntQ0zrEKrQSprIMLtaWgKJ9bBKQr4dsn0J7ZoYUgIJ+R6Sel8OhXEcHhC7LyM9bkgjIIu2U6i6kbe5asCJcEX28JEcHJIWfCjODnuc7OiogdzaMrHf8=&SM4k=DX6TxPgI |
request | POST http://www.antonio-vivaldi.mobi/fo8o/ |
request | GET http://www.antonio-vivaldi.mobi/fo8o/?mRfW=PTl5gU/3CD/Xhg5KAVLGoeqWcilDUK5FTZuVmm6gfrwSjnBrSraU5xyBGUoA1k9xMbAGIU7PLJqf1PTsNd74L3d6+NgzbyGN2pTsiSyIeh1B8hC/nFfIu9UZrk9ku3J39HvVUu8=&SM4k=DX6TxPgI |
request | POST http://www.magmadokum.com/fo8o/ |
request | GET http://www.magmadokum.com/fo8o/?mRfW=qL3nKp+YSjoaTomnND+fiETGbzpIgkHGMW8DXsDTZ4AADrD7Wpn1kxM1jYW2/C2WhyBblBh5NUSWrO5bZjyCcVkJYbxxq5QITB2h2xAyEikjbcoqZSmDOCeIE8A+B7hyBKIW8mw=&SM4k=DX6TxPgI |
request | POST http://www.rssnewscast.com/fo8o/ |
request | GET http://www.rssnewscast.com/fo8o/?mRfW=x3jV/ECx7FuzXOI+6CNaISj98UIEn47HyCIVaqWvGMMqpfz0YC5wNp/pxM1zEFNKv4nPeGfT8/lZrDaJmccs4488pD+gaHK32CxgTEs5a2vdBlM4hQBa8nlaMF5vesFSU19kJNk=&SM4k=DX6TxPgI |
request | POST http://www.techchains.info/fo8o/ |
request | GET http://www.techchains.info/fo8o/?mRfW=vefd0teQh+kbruh+iKW53cdcsQD4oFyRDgCUoL90YCYLczV+Hcc/VZ2eVbboy/u5EgiS3CnxBclKZHyNJ/4ALr08/A/SWk5lVGufGp2P4fG4f3GonqE4cYuaa0/JNC0RZIlRWrU=&SM4k=DX6TxPgI |
request | POST http://www.elettrosistemista.zip/fo8o/ |
request | GET http://www.elettrosistemista.zip/fo8o/?mRfW=bO1UBvtoHFNUmlWB73HniX/lRhcpQxU1qF418M7UHpKKa2cgLZsmK6mwaSCrivds7LXL3uoK+MTOMGhYNdwtdjBMQu6yx1bfgOYvdpbzJPd/eSD2kHjCkD+QxgbYBRdZBXmxn1k=&SM4k=DX6TxPgI |
request | POST http://www.3xfootball.com/fo8o/ |
request | POST http://www.kasegitai.tokyo/fo8o/ |
request | POST http://www.goldenjade-travel.com/fo8o/ |
request | POST http://www.antonio-vivaldi.mobi/fo8o/ |
request | POST http://www.magmadokum.com/fo8o/ |
request | POST http://www.rssnewscast.com/fo8o/ |
request | POST http://www.techchains.info/fo8o/ |
request | POST http://www.elettrosistemista.zip/fo8o/ |
description | netbtugc.exe tried to sleep 154 seconds, actually delayed analysis time by 154 seconds |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\ |
file | C:\Users\test22\AppData\Local\Chromium\User Data |
file | C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data |
file | C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data |
file | C:\Users\test22\AppData\Local\Temp\sqlite3.dll |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.vbs |
file | C:\Users\test22\AppData\Local\directory\.exe |
file | C:\Users\test22\AppData\Local\directory\.exe |
file | C:\Users\test22\AppData\Local\Temp\sqlite3.dll |
file | C:\Users\test22\AppData\Local\directory\.exe |
section | {u'size_of_data': u'0x0005ca00', u'virtual_address': u'0x000c8000', u'entropy': 7.896311483647067, u'name': u'.rsrc', u'virtual_size': u'0x0005c8b8'} | entropy | 7.89631148365 | description | A section with a high entropy has been found | |||||||||
entropy | 0.314249363868 | description | Overall entropy of this PE file is high |
file | C:\Users\test22\AppData\Local\AVAST Software\Browser\User Data |
file | C:\Users\test22\AppData\Local\AVG\Browser\User Data |
Lionic | Trojan.Win32.AutoIt.l!c |
CAT-QuickHeal | Trojan.AgentSM.S6640043 |
Skyhigh | BehavesLike.Win32.TrojanAitInject.tc |
ALYac | Trojan.GenericKD.73055996 |
Cylance | Unsafe |
VIPRE | Trojan.GenericKD.73055996 |
Sangfor | Trojan.Win32.Injector.Vmk9 |
BitDefender | Trojan.GenericKD.73055996 |
Arcabit | Trojan.Generic.D45ABEFC |
VirIT | Trojan.Win32.AutoIt_Heur.A |
Symantec | Trojan.Gen.2 |
Elastic | malicious (high confidence) |
ESET-NOD32 | a variant of Win32/Injector.Autoit.GBF |
APEX | Malicious |
McAfee | Artemis!092CD26903ED |
Avast | Win32:Malware-gen |
Kaspersky | Trojan-Spy.Win32.Noon.bgnk |
MicroWorld-eScan | Trojan.GenericKD.73055996 |
Emsisoft | Trojan.GenericKD.73055996 (B) |
McAfeeD | ti!65FAA8E45468 |
FireEye | Trojan.GenericKD.73055996 |
Sophos | Troj/AutoIt-DGJ |
Ikarus | Trojan.Autoit |
Detected | |
MAX | malware (ai score=86) |
Kingsoft | Win32.Trojan-Spy.Noon.bgnk |
Microsoft | Trojan:Win32/DorkBot.DU |
ZoneAlarm | Trojan-Spy.Win32.Noon.bgnk |
GData | Trojan.GenericKD.73055996 |
Varist | W32/AutoIt.YE.gen!Eldorado |
AhnLab-V3 | Trojan/Win.Injector.C5639377 |
DeepInstinct | MALICIOUS |
VBA32 | Trojan-Downloader.Autoit.gen |
Malwarebytes | Malware.AI.314447254 |
Panda | Trj/Chgt.AD |
TrendMicro-HouseCall | TROJ_GEN.F0D1C00F724 |
MaxSecure | Trojan.Malware.255249326.susgen |
Fortinet | AutoIt/Injector.GBC!tr |
AVG | Win32:Malware-gen |
Paloalto | generic.ml |
alibabacloud | Trojan[spy]:Win/Noon.bkfu |