weneedbestthingswithgreatnewsevengivenbestforentiretime.hta| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6403_us | April 9, 2025, 11:11 a.m. | April 9, 2025, 11:13 a.m. |
-
mshta.exe "C:\Windows\System32\mshta.exe" C:\Users\test22\AppData\Local\Temp\weneedbestthingswithgreatnewsevengivenbestforentiretime.hta
1448-
-
wscript.exe wscript //nologo "C:\Windows\Temp\abthainry.vbs"
2160 -
timeout.exe timeout /t 1 /nobreak
2284
-
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| paste.ee | 23.186.113.60 |
Suricata Alerts
Suricata TLS
No Suricata TLS
| file | C:\Windows\Temp\abthainry.vbs |
| file | C:\Windows\Temp\mosstrooper.bat |
| cmdline | "C:\Windows\System32\cmd.exe" /c C:\Windows\Temp\mosstrooper.bat |
| cmdline | cmd.exe /c C:\Windows\Temp\mosstrooper.bat |
| url | http://crl.comodo.net/TrustedCertificateServices.crl0 |
| url | http://users.ocsp.d-trust.net03 |
| url | http://crl.ssc.lt/root-b/cacrl.crl0 |
| url | http://crl.securetrust.com/STCA.crl0 |
| url | http://crl.securetrust.com/SGCA.crl0 |
| url | http://acraiz.icpbrasil.gov.br/DPCacraiz.pdf0= |
| url | http://www.ssc.lt/cps03 |
| url | http://www.informatik.admin.ch/PKI/links/CPS_2_16_756_1_17_3_1_0.pdf0 |
| url | http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAII.crl0 |
| url | http://www.digsigtrust.com/DST_TRUST_CPS_v990701.html0 |
| url | http://www.microsoft.com/pki/certs/TrustListPCA.crt0 |
| url | https://www.certification.tn/cgi-bin/pub/crl/cacrl.crl0 |
| url | http://www.pkioverheid.nl/policies/root-policy0 |
| url | http://cps.chambersign.org/cps/chambersroot.html0 |
| url | http://www.e-szigno.hu/SZSZ/0 |
| url | http://www.entrust.net/CRL/Client1.crl0 |
| url | http://crl.chambersign.org/publicnotaryroot.crl0 |
| url | http://crl.comodo.net/AAACertificateServices.crl0 |
| url | http://www.certplus.com/CRL/class3.crl0 |
| url | http://logo.verisign.com/vslogo.gif0 |
| url | http://www.acabogacia.org/doc0 |
| url | http://www.disig.sk/ca/crl/ca_disig.crl0 |
| url | https://www.catcert.net/verarrel |
| url | http://www.sk.ee/cps/0 |
| url | http://www.quovadis.bm0 |
| url | https://www.catcert.net/verarrel05 |
| url | http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAI.crl0 |
| url | http://crl.chambersign.org/chambersroot.crl0 |
| url | http://www.certificadodigital.com.br/repositorio/serasaca/crl/SerasaCAIII.crl0 |
| url | http://crl.globalsign.net/root-r2.crl0 |
| url | http://certificates.starfieldtech.com/repository/1604 |
| url | http://www.d-trust.net0 |
| url | http://pki-root.ecertpki.cl/CertEnroll/E-CERT%20ROOT%20CA.crl0 |
| url | http://crl.ssc.lt/root-a/cacrl.crl0 |
| url | http://crl.usertrust.com/UTN-DATACorpSGC.crl0 |
| url | http://www.certicamara.com/certicamaraca.crl0 |
| url | http://www.d-trust.net/crl/d-trust_root_class_2_ca_2007.crl0 |
| url | http://crl.usertrust.com/UTN-USERFirst-Object.crl0) |
| url | http://www.post.trust.ie/reposit/cps.html0 |
| url | http://qual.ocsp.d-trust.net0 |
| url | http://www2.public-trust.com/crl/ct/ctroot.crl0 |
| url | http://www.certicamara.com0 |
| url | http://www.pki.admin.ch/policy/CPS_2_16_756_1_17_3_21_1.pdf0 |
| url | http://fedir.comsign.co.il/cacert/ComSignAdvancedSecurityCA.crt0 |
| url | http://www.comsign.co.il/cps0 |
| url | http://crl.usertrust.com/UTN-USERFirst-NetworkApplications.crl0 |
| url | http://www.microsoft.com/pki/crl/products/TrustListPCA.crl |
| url | http://acraiz.icpbrasil.gov.br/LCRacraiz.crl0 |
| url | http://www.signatur.rtr.at/de/directory/cps.html0 |
| url | http://www.globaltrust.info0 |
| description | Create a windows service | rule | Create_Service | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
| description | Record Audio | rule | Sniff_Audio | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerCheck__RemoteAPI | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | DebuggerException__ConsoleCtrl | ||||||
| description | (no description) | rule | DebuggerException__SetConsoleCtrl | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | (no description) | rule | Check_Dlls | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Anti-Sandbox checks for ThreatExpert | rule | antisb_threatExpert | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Affect hook table | rule | win_hook | ||||||
| description | File Downloader | rule | Network_Downloader | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Install itself for autorun at Windows startup | rule | Persistence | ||||||
| description | Communications over FTP | rule | Network_FTP | ||||||
| description | Run a KeyLogger | rule | KeyLogger | ||||||
| description | Communications over P2P network | rule | Network_P2P_Win | ||||||
| file | C:\Windows\SysWOW64\wscript.exe |