geo.ps1| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6403_us | Oct. 18, 2024, 10:04 a.m. | Oct. 18, 2024, 10:07 a.m. |
-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\geo.ps1
1532-
cmd.exe "C:\Windows\system32\cmd.exe" /c md C:\ProgramData\mssts
2920 -
-
taskkill.exe taskkill /f /im dsm.exe
3020
-
-
-
taskkill.exe taskkill /f /im dom.exe
2328
-
-
-
taskkill.exe taskkill /f /im solr.exe
2588
-
-
cmd.exe "C:\Windows\system32\cmd.exe" /c del /f /q C:\Windows\System32\config\systemprofile\dom\*
2656 -
WMIC.exe "C:\Windows\System32\Wbem\WMIC.exe" process where "ExecutablePath like 'C:\\ProgramData\\Microsoft\\Windows\\Templates\\%'" delete
2712 -
cmd.exe "C:\Windows\system32\cmd.exe" /c del /f /q C:\ProgramData\Microsoft\Windows\Templates\*.exe
2960 -
WMIC.exe "C:\Windows\System32\Wbem\WMIC.exe" process where "ExecutablePath like 'C:\\ProgramData\\Microsoft\\Windows\\WER\\%'" delete
3052 -
cmd.exe "C:\Windows\system32\cmd.exe" /c del /f /q C:\ProgramData\Microsoft\Windows\WER\*
508 -
-
taskkill.exe taskkill /f /im JavaAccessBridge.exe
2620
-
-
cmd.exe "C:\Windows\system32\cmd.exe" /c del /f /q C:\Users\Public\Videos\*
2704 -
-
taskkill.exe taskkill /f /im kthreaddk.exe
2924
-
-
-
taskkill.exe taskkill /f /im sysupdate.exe
2636
-
-
-
taskkill.exe taskkill /f /im powershell.exe
2728
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
| IP Address | Status | Action |
|---|---|---|
| 1.255.85.176 | Active | Moloch |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
| cmdline | "C:\Windows\System32\Wbem\WMIC.exe" process where "ExecutablePath like 'C:\\ProgramData\\Microsoft\\Windows\\WER\\%'" delete |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im solr.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im powershell.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im kthreaddk.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im sysupdate.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im dsm.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im dom.exe |
| cmdline | taskkill /f /im powershell.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c del /f /q C:\ProgramData\Microsoft\Windows\WER\* |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im JavaAccessBridge.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c del /f /q C:\Windows\System32\config\systemprofile\dom\* |
| cmdline | "C:\Windows\system32\cmd.exe" /c del /f /q C:\Users\Public\Videos\* |
| cmdline | "C:\Windows\System32\Wbem\WMIC.exe" process where "ExecutablePath like 'C:\\ProgramData\\Microsoft\\Windows\\Templates\\%'" delete |
| cmdline | "C:\Windows\system32\cmd.exe" /c del /f /q C:\ProgramData\Microsoft\Windows\Templates\*.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c md C:\ProgramData\mssts |
| wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "sysupdate.exe") |
| wmi | select * from __EventFilter where Name='ActiveMq' |
| wmi | select * from __FilterToConsumerBinding where __Path LIKE '%subscription%' |
| wmi | SELECT * FROM Win32_Process WHERE ExecutablePath like 'C:\\ProgramData\\Microsoft\\Windows\\Templates\\%' |
| wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "dsm.exe") |
| wmi | SELECT * FROM Win32_Process WHERE ExecutablePath like 'C:\\ProgramData\\Microsoft\\Windows\\WER\\%' |
| wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "powershell.exe") |
| wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "solr.exe") |
| wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "dom.exe") |
| wmi | select * from CommandLineEventConsumer where Name='ActiveMq' |
| wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "JavaAccessBridge.exe") |
| wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "kthreaddk.exe") |
| wmi | select * from __FilterToConsumerBinding |
| cmdline | "C:\Windows\System32\Wbem\WMIC.exe" process where "ExecutablePath like 'C:\\ProgramData\\Microsoft\\Windows\\WER\\%'" delete |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im solr.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im powershell.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im kthreaddk.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im sysupdate.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im dsm.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im dom.exe |
| cmdline | taskkill /f /im powershell.exe |
| cmdline | taskkill /f /im dom.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c del /f /q C:\ProgramData\Microsoft\Windows\WER\* |
| cmdline | taskkill /f /im sysupdate.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im JavaAccessBridge.exe |
| cmdline | taskkill /f /im solr.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c del /f /q C:\Windows\System32\config\systemprofile\dom\* |
| cmdline | "C:\Windows\system32\cmd.exe" /c del /f /q C:\Users\Public\Videos\* |
| cmdline | taskkill /f /im kthreaddk.exe |
| cmdline | taskkill /f /im dsm.exe |
| cmdline | "C:\Windows\System32\Wbem\WMIC.exe" process where "ExecutablePath like 'C:\\ProgramData\\Microsoft\\Windows\\Templates\\%'" delete |
| cmdline | "C:\Windows\system32\cmd.exe" /c del /f /q C:\ProgramData\Microsoft\Windows\Templates\*.exe |
| cmdline | taskkill /f /im JavaAccessBridge.exe |
| host | 1.255.85.176 | |||
| file | C:\ProgramData\mssts\javas.exe |
| Cynet | Malicious (score: 99) |
| CTX | powershell.miner.pwsh |
| ALYac | Generic.PWSH.Miner.C.639B8AB5 |
| VIPRE | Generic.PWSH.Miner.C.639B8AB5 |
| Arcabit | Generic.PWSH.Miner.C.639B8AB5 |
| Symantec | Scr.Malcode!gen |
| ESET-NOD32 | PowerShell/CoinMiner.BW |
| Kaspersky | HEUR:Trojan.PowerShell.Generic |
| BitDefender | Generic.PWSH.Miner.C.639B8AB5 |
| MicroWorld-eScan | Generic.PWSH.Miner.C.639B8AB5 |
| Emsisoft | Generic.PWSH.Miner.C.639B8AB5 (B) |
| F-Secure | Trojan.TR/PShell.Miner.G |
| FireEye | Generic.PWSH.Miner.C.639B8AB5 |
| Avira | TR/PShell.Miner.G |
| Kingsoft | Script.Ks.Malware.1747 |
| ZoneAlarm | HEUR:Trojan.PowerShell.Generic |
| GData | Generic.PWSH.Miner.C.639B8AB5 |
| Tencent | Win32.Trojan.Generic.Ssmw |
| huorong | TrojanDownloader/PS.NetLoader.gc |
| parent_process | powershell.exe | martian_process | "C:\Windows\System32\Wbem\WMIC.exe" process where "ExecutablePath like 'C:\\ProgramData\\Microsoft\\Windows\\WER\\%'" delete | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\System32\Wbem\WMIC.exe" process where "ExecutablePath like 'C:\\ProgramData\\Microsoft\\Windows\\Templates\\%'" delete | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c del /f /q C:\ProgramData\Microsoft\Windows\Templates\*.exe | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c taskkill /f /im dom.exe | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c taskkill /f /im solr.exe | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c del /f /q C:\Windows\System32\config\systemprofile\dom\* | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c md C:\ProgramData\mssts | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c taskkill /f /im powershell.exe | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c del /f /q C:\Users\Public\Videos\* | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c taskkill /f /im kthreaddk.exe | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c del /f /q C:\ProgramData\Microsoft\Windows\WER\* | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c taskkill /f /im JavaAccessBridge.exe | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c taskkill /f /im sysupdate.exe | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c taskkill /f /im dsm.exe | ||||||
| parent_process | powershell.exe | martian_process | C:\ProgramData\mssts\javas.exe | ||||||
| dead_host | 1.255.85.176:8080 |
| file | C:\Windows\System32\cmd.exe |
| file | C:\Windows\System32\wbem\WMIC.exe |
| file | C:\ProgramData\mssts\javas.exe |