mq.ps1| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | Oct. 18, 2024, 10:04 a.m. | Oct. 18, 2024, 10:09 a.m. |
-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\mq.ps1
2552-
-
taskkill.exe taskkill /f /im dsm.exe
2760
-
-
-
taskkill.exe taskkill /f /im dom.exe
2912
-
-
cmd.exe "C:\Windows\system32\cmd.exe" /c del /f /q C:\Windows\System32\config\systemprofile\dom\*
2976 -
-
taskkill.exe taskkill /f /im WindowsUpdate.exe
3064
-
-
cmd.exe "C:\Windows\system32\cmd.exe" /c del /f /q C:\Windows\temp\WindowsUpdate.exe
2084 -
-
attrib.exe attrib -s -h -r C:\Users\test22\AppData\Local\Temp\config.json
148
-
-
-
attrib.exe attrib -s -h -r C:\Windows\temp\config.json
2272
-
-
cmd.exe "C:\Windows\system32\cmd.exe" /c rd /s /q %tmp%\config.json
2464 -
cmd.exe "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Windows\temp\config.json
2548 -
-
attrib.exe attrib +R +S +H C:\Users\test22\AppData\Local\Temp\config.json
2124
-
-
-
attrib.exe attrib +R +S +H C:\Windows\temp\config.json
2424
-
-
-
taskkill.exe taskkill /f /im shella.exe
2716
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
| IP Address | Status | Action |
|---|---|---|
| 1.255.85.176 | Active | Moloch |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
| cmdline | "C:\Windows\system32\cmd.exe" /c del /f /q C:\Windows\temp\WindowsUpdate.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im dom.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c del /f /q C:\Windows\System32\config\systemprofile\dom\* |
| cmdline | "C:\Windows\system32\cmd.exe" /c attrib +R +S +H C:\Windows\temp\config.json |
| cmdline | "C:\Windows\system32\cmd.exe" /c attrib +R +S +H %tmp%\config.json |
| cmdline | "C:\Windows\system32\cmd.exe" /c attrib -s -h -r C:\Windows\temp\config.json |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im WindowsUpdate.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c attrib -s -h -r %tmp%\config.json |
| cmdline | "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Windows\temp\config.json |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im dsm.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im shella.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c rd /s /q %tmp%\config.json |
| wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "dom.exe") |
| wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "dsm.exe") |
| wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "WindowsUpdate.exe") |
| wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "shella.exe") |
| cmdline | attrib -s -h -r C:\Users\test22\AppData\Local\Temp\config.json |
| cmdline | taskkill /f /im shella.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c del /f /q C:\Windows\temp\WindowsUpdate.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im dom.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c del /f /q C:\Windows\System32\config\systemprofile\dom\* |
| cmdline | "C:\Windows\system32\cmd.exe" /c attrib +R +S +H C:\Windows\temp\config.json |
| cmdline | "C:\Windows\system32\cmd.exe" /c attrib +R +S +H %tmp%\config.json |
| cmdline | "C:\Windows\system32\cmd.exe" /c attrib -s -h -r C:\Windows\temp\config.json |
| cmdline | attrib +R +S +H C:\Windows\temp\config.json |
| cmdline | taskkill /f /im WindowsUpdate.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im WindowsUpdate.exe |
| cmdline | taskkill /f /im dom.exe |
| cmdline | attrib +R +S +H C:\Users\test22\AppData\Local\Temp\config.json |
| cmdline | "C:\Windows\system32\cmd.exe" /c attrib -s -h -r %tmp%\config.json |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im dsm.exe |
| cmdline | taskkill /f /im dsm.exe |
| cmdline | attrib -s -h -r C:\Windows\temp\config.json |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im shella.exe |
| host | 1.255.85.176 | |||
| file | C:\Users\test22\AppData\Local\Temp\config.json |
| file | C:\Users\test22\AppData\Local\Temp\javas.exe |
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c attrib +R +S +H %tmp%\config.json | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c attrib +R +S +H C:\Windows\temp\config.json | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c rd /s /q %tmp%\config.json | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c taskkill /f /im dom.exe | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c del /f /q C:\Windows\System32\config\systemprofile\dom\* | ||||||
| parent_process | powershell.exe | martian_process | C:\Users\test22\AppData\Local\Temp\javas.exe | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c attrib -s -h -r C:\Windows\temp\config.json | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c taskkill /f /im WindowsUpdate.exe | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c attrib -s -h -r %tmp%\config.json | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Windows\temp\config.json | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c taskkill /f /im dsm.exe | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c del /f /q C:\Windows\temp\WindowsUpdate.exe | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c taskkill /f /im shella.exe | ||||||
| Lionic | Trojan.Script.PowerShell.4!c |
| Cynet | Malicious (score: 99) |
| CTX | powershell.miner.generic |
| Skyhigh | Artemis!Trojan |
| ALYac | Generic.PWSH.Miner.D.B2D9DF8E |
| VIPRE | Generic.PWSH.Miner.D.B2D9DF8E |
| Arcabit | Generic.PWSH.Miner.D.B2D9DF8E |
| Symantec | Scr.Malcode!gen |
| ESET-NOD32 | PowerShell/CoinMiner.BW |
| Avast | Script:SNH-gen [Trj] |
| Kaspersky | HEUR:Trojan.Script.Generic |
| BitDefender | Generic.PWSH.Miner.D.B2D9DF8E |
| MicroWorld-eScan | Generic.PWSH.Miner.D.B2D9DF8E |
| Emsisoft | Generic.PWSH.Miner.D.B2D9DF8E (B) |
| F-Secure | Trojan.TR/PShell.Miner.G |
| DrWeb | PowerShell.DownLoader.1760 |
| Ikarus | Trojan.PowerShell.Coinminer |
| FireEye | Generic.PWSH.Miner.D.B2D9DF8E |
| Detected | |
| Avira | TR/PShell.Miner.G |
| Kingsoft | Script.Trojan.Generic.a |
| Microsoft | Trojan:Script/Wacatac.B!ml |
| ZoneAlarm | HEUR:Trojan.Script.Generic |
| GData | Generic.PWSH.Miner.D.B2D9DF8E |
| Varist | ABMiner.WDSN-6 |
| AhnLab-V3 | Downloader/PowerShell.Miner.SC197176 |
| Tencent | Script.Trojan.Generic.Qzfl |
| AVG | Script:SNH-gen [Trj] |
| alibabacloud | Miner:Win/CoinMiner.BI |
| dead_host | 1.255.85.176:8080 |
| file | C:\Windows\System32\cmd.exe |
| file | C:\Users\test22\AppData\Local\Temp\javas.exe |