paste.ps1| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6403_us | Oct. 18, 2024, 10:05 a.m. | Oct. 18, 2024, 10:09 a.m. |
-
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\paste.ps1
800-
-
taskkill.exe taskkill /f /im dsm.exe
2160
-
-
-
taskkill.exe taskkill /f /im userinit.exe
2324
-
-
-
taskkill.exe taskkill /f /im dom.exe
2432
-
-
cmd.exe "C:\Windows\system32\cmd.exe" /c del /f /q C:\Windows\System32\config\systemprofile\dom\*
2496 -
-
taskkill.exe taskkill /f /im WindowsUpdate.exe
2584
-
-
cmd.exe "C:\Windows\system32\cmd.exe" /c del /f /q C:\Windows\temp\WindowsUpdate.exe
2648 -
-
attrib.exe attrib -s -h -r C:\Users\test22\AppData\Local\Temp\config.json
2780
-
-
-
attrib.exe attrib -s -h -r C:\Windows\temp\config.json
2884
-
-
cmd.exe "C:\Windows\system32\cmd.exe" /c rd /s /q %tmp%\config.json
2928 -
cmd.exe "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Windows\temp\config.json
2972 -
-
attrib.exe attrib +R +S +H C:\Users\test22\AppData\Local\Temp\config.json
2652
-
-
-
attrib.exe attrib +R +S +H C:\Windows\temp\config.json
2872
-
-
-
taskkill.exe taskkill /f /im shella.exe
3012
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
| IP Address | Status | Action |
|---|---|---|
| 112.217.207.130 | Active | Moloch |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
| cmdline | "C:\Windows\system32\cmd.exe" /c attrib +R +S +H %tmp%\config.json |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im dsm.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c rd /s /q %tmp%\config.json |
| cmdline | "C:\Windows\system32\cmd.exe" /c attrib +R +S +H C:\Windows\temp\config.json |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im dom.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c attrib -s -h -r C:\Windows\temp\config.json |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im WindowsUpdate.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Windows\temp\config.json |
| cmdline | "C:\Windows\system32\cmd.exe" /c del /f /q C:\Windows\System32\config\systemprofile\dom\* |
| cmdline | "C:\Windows\system32\cmd.exe" /c attrib -s -h -r %tmp%\config.json |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im shella.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im userinit.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c del /f /q C:\Windows\temp\WindowsUpdate.exe |
| wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "userinit.exe") |
| wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "dom.exe") |
| wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "dsm.exe") |
| wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "WindowsUpdate.exe") |
| wmi | SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "shella.exe") |
| cmdline | "C:\Windows\system32\cmd.exe" /c attrib +R +S +H %tmp%\config.json |
| cmdline | attrib +R +S +H C:\Users\test22\AppData\Local\Temp\config.json |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im dsm.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c attrib +R +S +H C:\Windows\temp\config.json |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im dom.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c attrib -s -h -r C:\Windows\temp\config.json |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im WindowsUpdate.exe |
| cmdline | taskkill /f /im dom.exe |
| cmdline | attrib -s -h -r C:\Windows\temp\config.json |
| cmdline | attrib -s -h -r C:\Users\test22\AppData\Local\Temp\config.json |
| cmdline | "C:\Windows\system32\cmd.exe" /c del /f /q C:\Windows\System32\config\systemprofile\dom\* |
| cmdline | attrib +R +S +H C:\Windows\temp\config.json |
| cmdline | "C:\Windows\system32\cmd.exe" /c attrib -s -h -r %tmp%\config.json |
| cmdline | taskkill /f /im dsm.exe |
| cmdline | taskkill /f /im userinit.exe |
| cmdline | taskkill /f /im shella.exe |
| cmdline | taskkill /f /im WindowsUpdate.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im shella.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c taskkill /f /im userinit.exe |
| cmdline | "C:\Windows\system32\cmd.exe" /c del /f /q C:\Windows\temp\WindowsUpdate.exe |
| host | 112.217.207.130 | |||
| file | C:\Users\test22\AppData\Local\Temp\javas.exe |
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c attrib +R +S +H %tmp%\config.json | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c attrib +R +S +H C:\Windows\temp\config.json | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c rd /s /q %tmp%\config.json | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c taskkill /f /im dom.exe | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c del /f /q C:\Windows\System32\config\systemprofile\dom\* | ||||||
| parent_process | powershell.exe | martian_process | C:\Users\test22\AppData\Local\Temp\javas.exe | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c attrib -s -h -r C:\Windows\temp\config.json | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c taskkill /f /im WindowsUpdate.exe | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c attrib -s -h -r %tmp%\config.json | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Windows\temp\config.json | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c taskkill /f /im dsm.exe | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c taskkill /f /im userinit.exe | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c del /f /q C:\Windows\temp\WindowsUpdate.exe | ||||||
| parent_process | powershell.exe | martian_process | "C:\Windows\system32\cmd.exe" /c taskkill /f /im shella.exe | ||||||
| Cynet | Malicious (score: 99) |
| CTX | powershell.miner.pwsh |
| Skyhigh | Artemis!Trojan |
| ALYac | Generic.PWSH.Miner.D.8697786F |
| VIPRE | Generic.PWSH.Miner.D.8697786F |
| Arcabit | Generic.PWSH.Miner.D.D84B7BAF |
| Symantec | Scr.Malcode!gen |
| ESET-NOD32 | PowerShell/CoinMiner.BW |
| Avast | Script:SNH-gen [Trj] |
| Kaspersky | HEUR:Trojan.Script.Generic |
| BitDefender | Generic.PWSH.Miner.D.8697786F |
| MicroWorld-eScan | Generic.PWSH.Miner.D.8697786F |
| Emsisoft | Generic.PWSH.Miner.D.8697786F (B) |
| F-Secure | Trojan.TR/PShell.Miner.G |
| DrWeb | PowerShell.DownLoader.1760 |
| Ikarus | Trojan.PowerShell.Coinminer |
| FireEye | Generic.PWSH.Miner.D.8697786F |
| Detected | |
| Avira | TR/PShell.Miner.G |
| Kingsoft | Script.Trojan.Generic.a |
| Microsoft | Trojan:Script/Wacatac.B!ml |
| ZoneAlarm | HEUR:Trojan.Script.Generic |
| GData | Generic.PWSH.Miner.D.8697786F |
| AhnLab-V3 | Downloader/PowerShell.Miner.SC197176 |
| Tencent | Script.Trojan.Generic.Ztjl |
| AVG | Script:SNH-gen [Trj] |
| dead_host | 112.217.207.130:80 |
| file | C:\Windows\System32\cmd.exe |
| file | C:\Users\test22\AppData\Local\Temp\javas.exe |