Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | June 9, 2024, 9:11 a.m. | June 9, 2024, 9:15 a.m. |
-
-
-
svchost.exe "C:\Users\test22\AppData\Local\Temp\Delivery%2007.exe"
2712
-
-
-
-
firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
3052
-
-
explorer.exe C:\Windows\Explorer.EXE
1452
IP Address | Status | Action |
---|---|---|
116.50.37.244 | Active | Moloch |
154.215.72.110 | Active | Moloch |
164.124.101.2 | Active | Moloch |
195.110.124.133 | Active | Moloch |
202.172.28.202 | Active | Moloch |
23.227.38.74 | Active | Moloch |
45.33.6.223 | Active | Moloch |
46.30.213.191 | Active | Moloch |
66.29.149.46 | Active | Moloch |
85.159.66.93 | Active | Moloch |
91.195.240.94 | Active | Moloch |
Suricata Alerts
Suricata TLS
No Suricata TLS
request | POST http://www.3xfootball.com/fo8o/ |
request | GET http://www.3xfootball.com/fo8o/?Q1=IhZyPQIGe6uK3zPwwQVGm4hCASyaX3xlW2eS79Xk6ut4afzj0LiRHBqZsEmyTx+18GfGhVOagMos+c9dx/PGjLGAfpOvJ7U3hUqpnKd0zHv/hQdGhX4G3JlCydyJ23yerjxn4r8=&niTnW=y25C |
request | GET http://www.sqlite.org/2019/sqlite-dll-win32-x86-3290000.zip |
request | POST http://www.kasegitai.tokyo/fo8o/ |
request | GET http://www.kasegitai.tokyo/fo8o/?Q1=0LNqIGaAWMhMIMLOr1FzuAu+QFTp+Isr9lFre+yu3/9GvRNYi1uHghhDsQ/pqDAQ+wkUrFUIurr7TLyDqzId9vCn3h40hICDSYZjejM1bTxHHnFMxARLyMCZMUhSp6GMEGHL0HI=&niTnW=y25C |
request | POST http://www.goldenjade-travel.com/fo8o/ |
request | GET http://www.goldenjade-travel.com/fo8o/?Q1=LFKqyrcu7g1NCa8bIVnmntQ0zrEKrQSprIMLtaWgKJ9bBKQr4dsn0J7ZoYUgIJ+R6Sel8OhXEcHhC7LyM9bkgjIIu2U6i6kbe5asCJcEX28JEcHJIWfCjODnuc7OiogdzaMrHf8=&niTnW=y25C |
request | POST http://www.antonio-vivaldi.mobi/fo8o/ |
request | GET http://www.antonio-vivaldi.mobi/fo8o/?Q1=PTl5gU/3CD/Xhg5KAVLGoeqWcilDUK5FTZuVmm6gfrwSjnBrSraU5xyBGUoA1k9xMbAGIU7PLJqf1PTsNd74L3d6+NgzbyGN2pTsiSyIeh1B8hC/nFfIu9UZrk9ku3J39HvVUu8=&niTnW=y25C |
request | POST http://www.magmadokum.com/fo8o/ |
request | GET http://www.magmadokum.com/fo8o/?Q1=qL3nKp+YSjoaTomnND+fiETGbzpIgkHGMW8DXsDTZ4AADrD7Wpn1kxM1jYW2/C2WhyBblBh5NUSWrO5bZjyCcVkJYbxxq5QITB2h2xAyEikjbcoqZSmDOCeIE8A+B7hyBKIW8mw=&niTnW=y25C |
request | POST http://www.rssnewscast.com/fo8o/ |
request | GET http://www.rssnewscast.com/fo8o/?Q1=x3jV/ECx7FuzXOI+6CNaISj98UIEn47HyCIVaqWvGMMqpfz0YC5wNp/pxM1zEFNKv4nPeGfT8/lZrDaJmccs4488pD+gaHK32CxgTEs5a2vdBlM4hQBa8nlaMF5vesFSU19kJNk=&niTnW=y25C |
request | POST http://www.techchains.info/fo8o/ |
request | GET http://www.techchains.info/fo8o/?Q1=vefd0teQh+kbruh+iKW53cdcsQD4oFyRDgCUoL90YCYLczV+Hcc/VZ2eVbboy/u5EgiS3CnxBclKZHyNJ/4ALr08/A/SWk5lVGufGp2P4fG4f3GonqE4cYuaa0/JNC0RZIlRWrU=&niTnW=y25C |
request | POST http://www.elettrosistemista.zip/fo8o/ |
request | GET http://www.elettrosistemista.zip/fo8o/?Q1=bO1UBvtoHFNUmlWB73HniX/lRhcpQxU1qF418M7UHpKKa2cgLZsmK6mwaSCrivds7LXL3uoK+MTOMGhYNdwtdjBMQu6yx1bfgOYvdpbzJPd/eSD2kHjCkD+QxgbYBRdZBXmxn1k=&niTnW=y25C |
request | POST http://www.donnavariedades.com/fo8o/ |
request | GET http://www.donnavariedades.com/fo8o/?Q1=l+301ZvITCxaX9AA7VU8BaNl0giE4t3JgzctOQx29qSsrxX8kw490hU6vymbZWA2w8GmYCogcgx/MI4pNd8ITQiOXzox9fl9oCNBaJd4bIe7oyUKC5LhLVNYvjLZULJxgsfERiI=&niTnW=y25C |
request | POST http://www.3xfootball.com/fo8o/ |
request | POST http://www.kasegitai.tokyo/fo8o/ |
request | POST http://www.goldenjade-travel.com/fo8o/ |
request | POST http://www.antonio-vivaldi.mobi/fo8o/ |
request | POST http://www.magmadokum.com/fo8o/ |
request | POST http://www.rssnewscast.com/fo8o/ |
request | POST http://www.techchains.info/fo8o/ |
request | POST http://www.elettrosistemista.zip/fo8o/ |
request | POST http://www.donnavariedades.com/fo8o/ |
description | netbtugc.exe tried to sleep 160 seconds, actually delayed analysis time by 160 seconds |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\ |
file | C:\Users\test22\AppData\Local\Chromium\User Data |
file | C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data |
file | C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data |
file | C:\Users\test22\AppData\Local\Temp\sqlite3.dll |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.vbs |
file | C:\Users\test22\AppData\Local\directory\.exe |
file | C:\Users\test22\AppData\Local\directory\.exe |
file | C:\Users\test22\AppData\Local\directory\.exe |
file | C:\Users\test22\AppData\Local\Temp\sqlite3.dll |
section | {u'size_of_data': u'0x00061200', u'virtual_address': u'0x000c8000', u'entropy': 7.903942808101959, u'name': u'.rsrc', u'virtual_size': u'0x00061184'} | entropy | 7.9039428081 | description | A section with a high entropy has been found | |||||||||
entropy | 0.324561403509 | description | Overall entropy of this PE file is high |
file | C:\Users\test22\AppData\Local\AVAST Software\Browser\User Data |
file | C:\Users\test22\AppData\Local\AVG\Browser\User Data |
Lionic | Trojan.Win32.Autoit.l!c |
Skyhigh | BehavesLike.Win32.TrojanAitInject.tc |
ALYac | AIT:Trojan.Nymeria.6093 |
Cylance | Unsafe |
VIPRE | AIT:Trojan.Nymeria.6093 |
Sangfor | Trojan.Win32.Autoit.V0jr |
BitDefender | Trojan.GenericKD.73071651 |
Arcabit | Trojan.Generic.D45AFC23 |
VirIT | Trojan.Win32.AutoIt_Heur.A |
Symantec | Trojan.Gen.2 |
Elastic | malicious (high confidence) |
ESET-NOD32 | a variant of Win32/Injector.Autoit.GBC |
APEX | Malicious |
McAfee | Artemis!B94B6C27E410 |
Avast | Win32:Malware-gen |
Kaspersky | Trojan-Spy.Win32.Noon.bgmg |
MicroWorld-eScan | Trojan.GenericKD.73071651 |
Emsisoft | Trojan.GenericKD.73071651 (B) |
McAfeeD | ti!26833834EFB8 |
FireEye | Trojan.GenericKD.73071651 |
Sophos | Troj/AutoIt-DGJ |
Ikarus | Win32.Outbreak |
Detected | |
MAX | malware (ai score=81) |
Kingsoft | Win32.Trojan-Spy.Noon.bgmg |
Microsoft | Trojan:Win32/Autoit!MTB |
ZoneAlarm | Trojan-Spy.Win32.Noon.bgmg |
GData | Win32.Trojan-Stealer.FormBook.VTRB7V |
Varist | W32/AutoIt.YE.gen!Eldorado |
AhnLab-V3 | Trojan/Win.Injector.C5632962 |
DeepInstinct | MALICIOUS |
VBA32 | Trojan-Downloader.Autoit.gen |
Malwarebytes | Trojan.Injector.AutoIt |
Panda | Trj/Chgt.AD |
TrendMicro-HouseCall | TROJ_GEN.F0D1C00F524 |
MaxSecure | Trojan.Malware.300983.susgen |
Fortinet | W32/Injector_Autoit.GBC!tr |
AVG | Win32:Malware-gen |
Paloalto | generic.ml |
alibabacloud | Trojan[spy]:Win/Noon.bknz |