request.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6403_us | Aug. 11, 2024, 2:30 p.m. | Aug. 11, 2024, 3:07 p.m. |
-
-
schtasks.exe C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\test22\msvcservice.exe" /F
2136 -
-
schtasks.exe C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\test22\msvcservice.exe" /F
2276
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| ip-api.io | 212.132.117.42 |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 212.132.117.42:443 -> 192.168.56.103:49167 | 2029340 | ET INFO TLS Handshake Failure | Potentially Bad Traffic |
| TCP 192.168.56.103:49166 -> 212.132.117.42:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| UDP 192.168.56.103:52760 -> 164.124.101.2:53 | 2039045 | ET INFO External IP Lookup Domain (ip-api .io) in DNS Lookup | Device Retrieving External IP Address Detected |
| TCP 192.168.56.103:49165 -> 212.132.117.42:443 | 906200054 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
No Suricata TLS
| description | request.exe tried to sleep 540 seconds, actually delayed analysis time by 0 seconds | |||
| cmdline | C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\test22\msvcservice.exe" /F |
| wmi | SELECT * FROM Win32_Processor |
| wmi | SELECT * FROM Win32_BaseBoard |
| wmi | SELECT * FROM Win32_DiskDrive |
| cmdline | C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\test22\msvcservice.exe" /F |
| wmi | SELECT * FROM Win32_Processor |
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msvcservice | reg_value | C:\Users\test22\msvcservice.exe | ||||||
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\msvcservice | reg_value | C:\Users\test22\msvcservice.exe | ||||||
| cmdline | C:\Windows\System32\schtasks.exe /Create /SC MINUTE /MO 1 /TN msvcservice /TR "C:\Users\test22\msvcservice.exe" /F | ||||||||
| file | C:\Users\admin\Documents\Outlook Files\honey@pot.com.pst |
| Bkav | W32.AIDetectMalware |
| Elastic | malicious (high confidence) |
| MicroWorld-eScan | Gen:Heur.Mint.SP.Sneaky.1 |
| Skyhigh | BehavesLike.Win32.Generic.fh |
| Cylance | Unsafe |
| VIPRE | Gen:Heur.Mint.SP.Sneaky.1 |
| Sangfor | Trojan.Win32.Save.a |
| BitDefender | Gen:Heur.Mint.SP.Sneaky.1 |
| Cybereason | malicious.ace6f7 |
| Arcabit | Trojan.Mint.SP.Sneaky.1 |
| Symantec | ML.Attribute.HighConfidence |
| APEX | Malicious |
| Cynet | Malicious (score: 100) |
| Kaspersky | VHO:Trojan-Dropper.Win32.Dorifel.gen |
| Emsisoft | Gen:Heur.Mint.SP.Sneaky.1 (B) |
| F-Secure | Trojan.TR/Hijacker.Gen |
| McAfeeD | Real Protect-LS!EF8320EACE6F |
| FireEye | Generic.mg.ef8320eace6f7532 |
| Sophos | ML/PE-A |
| Avira | TR/Hijacker.Gen |
| MAX | malware (ai score=80) |
| Kingsoft | malware.kb.a.989 |
| Microsoft | Trojan:Win32/Amadey.KAA!MTB |
| ZoneAlarm | VHO:Trojan-Dropper.Win32.Dorifel.gen |
| GData | Gen:Heur.Mint.SP.Sneaky.1 |
| AhnLab-V3 | Trojan/Win.Generic.C5644986 |
| BitDefenderTheta | AI:Packer.8C9622AE1E |
| DeepInstinct | MALICIOUS |
| VBA32 | BScope.Trojan.Wacatac |
| huorong | HVM:Trojan/MalBehav.gen!A |
| CrowdStrike | win/malicious_confidence_100% (D) |