Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | July 15, 2024, 4:37 p.m. | July 15, 2024, 4:39 p.m. |
-
kkm.exe "C:\Users\test22\AppData\Local\Temp\kkm.exe"
2552 -
explorer.exe C:\Windows\Explorer.EXE
1452
Name | Response | Post-Analysis Lookup |
---|---|---|
No hosts contacted. |
IP Address | Status | Action |
---|---|---|
No hosts contacted. |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
section | .ndata |
file | C:\Users\test22\AppData\Roaming\KkmAgent\Newtonsoft.Json.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\KKMCommon.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\KKMAgent.exe |
file | C:\Users\test22\AppData\Roaming\KkmAgent\Atol.Drivers10.Fptr.dll |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Avermaster\KKMAgent.lnk |
file | C:\Users\test22\AppData\Roaming\KkmAgent\RabbitMQ.Client.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\ManagedOpenSsl.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\HtmlAgilityPack.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\TSCLIB.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\Microsoft.Diagnostics.Tracing.EventSource.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\KKMLib.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\uninstall.exe |
file | C:\Users\test22\AppData\Local\Temp\nsgED7D.tmp\nsProcess.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\AutoUpdater.NET.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\QRCoder.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\NLog.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\PilotNtSharp.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\SushkofWin32Lib.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\DualConnector.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\BarcodeLib.dll |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Avermaster\KKMAgent.lnk |
file | C:\Users\test22\AppData\Roaming\KkmAgent\Newtonsoft.Json.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\DualConnector.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\AutoUpdater.NET.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\SushkofWin32Lib.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\QRCoder.dll |
file | C:\Users\test22\AppData\Local\Temp\nsgED7D.tmp\nsProcess.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\RabbitMQ.Client.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\ManagedOpenSsl.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\NLog.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\KKMLib.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\Microsoft.Diagnostics.Tracing.EventSource.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\KKMCommon.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\PilotNtSharp.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\uninstall.exe |
file | C:\Users\test22\AppData\Roaming\KkmAgent\HtmlAgilityPack.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\TSCLIB.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\KKMAgent.exe |
file | C:\Users\test22\AppData\Roaming\KkmAgent\Atol.Drivers10.Fptr.dll |
file | C:\Users\test22\AppData\Roaming\KkmAgent\BarcodeLib.dll |
reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\KKMAgent | reg_value | C:\Users\test22\AppData\Roaming\KkmAgent\KKMAgent.exe |
Bkav | W32.AIDetectMalware |
Lionic | Trojan.Win32.RansomX.j!c |
Elastic | malicious (high confidence) |
Cynet | Malicious (score: 100) |
ALYac | Trojan.Generic.36525039 |
Cylance | Unsafe |
VIPRE | Trojan.Generic.36525039 |
Sangfor | Ransom.Win32.Agent.V8yd |
BitDefender | Trojan.Generic.36525039 |
Arcabit | Trojan.Generic.D22D53EF |
Symantec | Trojan.Gen.MBT |
APEX | Malicious |
McAfee | Artemis!AB6CA8E3D0C7 |
Avast | NSIS:RansomX-gen [Ransom] |
Kaspersky | HEUR:Trojan-Ransom.Win32.Gen.gen |
Alibaba | Ransom:Win32/RansomX.9d864cde |
MicroWorld-eScan | Trojan.Generic.36525039 |
Emsisoft | Trojan.Generic.36525039 (B) |
F-Secure | Trojan.TR/Ransom.Agent.sdjua |
TrendMicro | Ransom_Gen.R011C0XGB24 |
McAfeeD | ti!6DA4696B8047 |
Trapmine | malicious.moderate.ml.score |
FireEye | Generic.mg.ab6ca8e3d0c7967c |
Sophos | Mal/Generic-S |
Avira | TR/Ransom.Agent.sdjua |
MAX | malware (ai score=85) |
Kingsoft | Win32.Trojan-Ransom.Gen.gen |
Gridinsoft | Ransom.Win32.AI.sa |
Microsoft | Program:Win32/Wacapew.C!ml |
ZoneAlarm | HEUR:Trojan-Ransom.Win32.Gen.gen |
GData | Trojan.Generic.36525039 |
DeepInstinct | MALICIOUS |
Malwarebytes | Malware.AI.1865480811 |
TrendMicro-HouseCall | Ransom_Gen.R011C0XGB24 |
SentinelOne | Static AI - Suspicious PE |
MaxSecure | Trojan.Malware.73859634.susgen |
Fortinet | W32/PossibleThreat |
AVG | NSIS:RansomX-gen [Ransom] |
Paloalto | generic.ml |
CrowdStrike | win/malicious_confidence_60% (D) |