|
danger |
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) |
|
danger |
File has been identified by 30 AntiVirus engines on VirusTotal as malicious |
|
watch |
Drops a binary and executes it |
|
watch |
Executes one or more WMI queries |
|
watch |
Installs itself for autorun at Windows startup |
|
watch |
Network communications indicative of a potential document or script payload download was initiated by the process wscript.exe |
|
watch |
One or more non-whitelisted processes were created |
|
watch |
The process wscript.exe wrote an executable file to disk |
|
watch |
Wscript.exe initiated network communications indicative of a script based payload download |
|
watch |
wscript.exe-based dropper (JScript |
|
notice |
Allocates read-write-execute memory (usually to unpack itself) |
|
notice |
Connects to a Dynamic DNS Domain |
|
notice |
Creates executable files on the filesystem |
|
notice |
Executes one or more WMI queries which can be used to identify virtual machines |
|
notice |
Looks up the external IP address |
|
notice |
Performs some HTTP requests |
|
notice |
Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation |
|
info |
One or more processes crashed |
|
info |
Queries for the computername |
