Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | July 26, 2024, 10:43 a.m. | July 26, 2024, 10:47 a.m. |
-
-
svchost.exe "C:\Users\test22\AppData\Local\Temp\industries.exe"
2636
-
-
-
firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
1404
-
-
explorer.exe C:\Windows\Explorer.EXE
1452
IP Address | Status | Action |
---|---|---|
103.224.182.242 | Active | Moloch |
15.197.148.33 | Active | Moloch |
164.124.101.2 | Active | Moloch |
172.67.133.217 | Active | Moloch |
203.161.42.161 | Active | Moloch |
3.33.130.190 | Active | Moloch |
45.33.6.223 | Active | Moloch |
66.81.203.10 | Active | Moloch |
81.169.145.84 | Active | Moloch |
84.32.84.32 | Active | Moloch |
85.13.154.127 | Active | Moloch |
Suricata Alerts
Flow | SID | Signature | Category |
---|---|---|---|
UDP 192.168.56.101:52753 -> 164.124.101.2:53 | 2023883 | ET DNS Query to a *.top domain - Likely Hostile | Potentially Bad Traffic |
UDP 192.168.56.101:53004 -> 164.124.101.2:53 | 2027863 | ET INFO Observed DNS Query to .biz TLD | Potentially Bad Traffic |
TCP 192.168.56.101:49182 -> 172.67.133.217:80 | 2032991 | ET INFO HTTP Request to a *.buzz domain | Potentially Bad Traffic |
TCP 192.168.56.101:49183 -> 203.161.42.161:80 | 2023882 | ET INFO HTTP Request to a *.top domain | Potentially Bad Traffic |
Suricata TLS
No Suricata TLS
request | POST http://www.summitpublications.net/ra7c/ |
request | GET http://www.summitpublications.net/ra7c/?MX7FkojV=SvKeswTuzWazx34ZRwNYWOUL+4Qzi3RGXdHaFUpExCUZEgDUs1lV719mAF8EtsBn/AVD65QVQa8ibY4gFbZqCpH5b+leOD1Jj6HueKbZfx9J0tpKEMSaJYca0b0uZ3KvEkzLgBc=&2Oj70=wymB9 |
request | GET http://www.sqlite.org/2021/sqlite-dll-win32-x86-3340000.zip |
request | GET http://www.sqlite.org/2022/sqlite-dll-win32-x86-3370000.zip |
request | GET http://www.sqlite.org/2019/sqlite-dll-win32-x86-3280000.zip |
request | GET http://www.hyattcreekoutpost.biz/sz4t/?MX7FkojV=PqYvDSUa5xpzdedq5tdpwiJC3gthoupmRjBzzJ3FbntVibPZI1/EKZl9s9hOn0Zmb9xaCSNsWJoSe51ux6SQqL8VwrNWtNbiyPi6OavNpFulETA7IisDPhWpDVcfmzCLy1FFmkA=&2Oj70=wymB9 |
request | GET http://www.coremagic.dev/rvsk/?MX7FkojV=Q6rrnvlrZTKYSle47xg6Y6OwSS9N0FqK+Mj9cH/UpKnUyMI1FWbgFk/FlNfWovow3hwVTGhvILolNNo3GNpr7hq9bWNUl6+SP6zUu/gjCFkqdjEUw+tJr6mTAbu4eV1uJ6YGGN8=&2Oj70=wymB9 |
request | GET http://www.butlay.website/u759/?MX7FkojV=MCukImoArEyLOTWqdQ1z2ePajSp2A5/BJZ6VTOICmOwJAgwJdKZCqOuSR5fILSmCknZcGV/72lN4bKl6niuzWckaU42fOjXxFvVyCgHozLVBKAJAIlIa8E7shRk9RybY7kmvMQk=&2Oj70=wymB9 |
request | GET http://www.tepco-co.online/hkxp/?MX7FkojV=gPAUIlTRKA7qXOL1ZTlMStdeIysZD39Vk2/re0B3mS8rGAQ0GotM5sSvAkfRsadCl6ftFGx2rGJjUrcRh8RdozefQI8XmfbOp1GwBEXiGavuSYQFbTIXZtPOAEv8EMoS+0xwku0=&2Oj70=wymB9 |
request | GET http://www.balneo.shop/9kwt/?MX7FkojV=/fSY3QZdojWpNRWxwqctiQNAdxt1JuBXe68kaBTFsj+2jUSklURH6kjWh0GMyO+4mMP491VErEY7I0ob1VlJfdzB+SlT7K2iZIvlJJCUvillQoZjNNO9VKVTJ25PKBfJXbttaTY=&2Oj70=wymB9 |
request | GET http://www.teandone.buzz/o6pn/?MX7FkojV=UJn6hLCr5CE83JGsiFr6F3dlh+gjmnQgpGSYIUWsdErR1O5ttgS2rCz/oa92Vy1JsAs4Vb0vhE186yqRppZqSaM6EjKfJ/MzG1s7XTw2DqO7xvMmiA2yEfwBZPs4V1K4aWoq150=&2Oj70=wymB9 |
request | GET http://www.mospos.top/q66s/?MX7FkojV=WxU+nNp+nJpz7Op4b6PDRlI6uXxtCFalh3oS6b0UMJSG3vkyp0IBCXywBW0+wHruShb13AiiEAiVUnW1+sH/RYwiBhm8QqKdAs/yfan11L/sTt125NYKX4Rdp1lkm/iDq+nnZa4=&2Oj70=wymB9 |
request | GET http://www.sweatequitypac.org/raxq/?MX7FkojV=x7NDGsgoCWTIEJ1tNCkkA1f2sMsJkFt2/Kg/6Gal8l5Ws0UwXECJP572vAzACYdkP61pUsrmPyJQfMGcau4sPIxMO6OtXz5Fl6YkZsF6thbJOhJ/u+Iz2uLJY5XPwE+BFsUyCr8=&2Oj70=wymB9 |
request | POST http://www.summitpublications.net/ra7c/ |
domain | www.mospos.top | description | Generic top level domain TLD |
description | taskkill.exe tried to sleep 148 seconds, actually delayed analysis time by 148 seconds |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\ |
file | C:\Users\test22\AppData\Local\Chromium\User Data |
file | C:\Users\test22\AppData\Local\MapleStudio\ChromePlus\User Data |
file | C:\Users\test22\AppData\Local\Yandex\YandexBrowser\User Data |
file | C:\Users\test22\AppData\Local\Temp\sqlite3.dll |
file | C:\Users\test22\AppData\Local\Temp\sqlite3.dll |
section | {u'size_of_data': u'0x00059800', u'virtual_address': u'0x000d4000', u'entropy': 7.897232861989734, u'name': u'.rsrc', u'virtual_size': u'0x000596cc'} | entropy | 7.89723286199 | description | A section with a high entropy has been found | |||||||||
entropy | 0.294529000411 | description | Overall entropy of this PE file is high |
file | C:\Users\test22\AppData\Local\AVAST Software\Browser\User Data |
file | C:\Users\test22\AppData\Local\AVG\Browser\User Data |
Bkav | W32.AIDetectMalware |
Lionic | Trojan.Win64.Injects.ts93 |
Elastic | malicious (high confidence) |
Cynet | Malicious (score: 100) |
Skyhigh | BehavesLike.Win32.Injector.tc |
ALYac | Trojan.Generic.36624229 |
Cylance | Unsafe |
VIPRE | Trojan.Generic.36624229 |
Sangfor | Trojan.Win32.Save.a |
BitDefender | Trojan.Generic.36624229 |
VirIT | Trojan.Win32.AutoIt_Heur.A |
Symantec | ML.Attribute.HighConfidence |
ESET-NOD32 | a variant of Win32/Injector.Autoit.GEN |
McAfee | Artemis!B77405E92A85 |
Avast | Win32:Malware-gen |
ClamAV | Win.Trojan.Autoit-10033720-0 |
Kaspersky | Trojan.Win32.Strab.mmw |
Alibaba | Trojan:Win32/Strab.4339cf4b |
MicroWorld-eScan | Trojan.Generic.36624229 |
Rising | Trojan.Injector/Autoit!1.F5AA (CLASSIC) |
Emsisoft | Trojan.Generic.36624229 (B) |
F-Secure | Trojan.TR/AD.ShellcodeCrypter.lcktc |
McAfeeD | Real Protect-LS!B77405E92A85 |
FireEye | Generic.mg.b77405e92a8557ab |
Sophos | Troj/AutoIt-DGJ |
Webroot | W32.Adware.Gen |
Detected | |
Avira | TR/AD.ShellcodeCrypter.lcktc |
MAX | malware (ai score=84) |
Kingsoft | Win32.Trojan.Strab.mmw |
Gridinsoft | Ransom.Win32.Sabsik.sa |
Microsoft | Trojan:Win32/Strab.GP!MTB |
ZoneAlarm | Trojan.Win32.Strab.mmw |
GData | Trojan.Generic.36624229 |
Varist | W32/ABTrojan.GPAM-2932 |
BitDefenderTheta | Gen:NN.ZexaF.36810.mvW@aORe4zgi |
DeepInstinct | MALICIOUS |
VBA32 | Trojan-Downloader.Autoit.gen |
Malwarebytes | Trojan.Injector.AutoIt |
Ikarus | Trojan.Autoit |
Panda | Trj/CI.A |
TrendMicro-HouseCall | TROJ_GEN.R002H01GO24 |
Tencent | Win32.Trojan.Strab.Ddhl |
MaxSecure | Trojan.Malware.300983.susgen |
Fortinet | AutoIt/Injector.AAD!tr |
AVG | Win32:Malware-gen |
Paloalto | generic.ml |
CrowdStrike | win/malicious_confidence_100% (W) |