Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Xirnkxhvuzwepe.cmd
|
ISO-8859 text, with very long lines (984), with CRLF line terminators
|
initial sample
|
 |
|
|
C:\Users\Public\CLEAN.GIF
|
ASCII text, with very long lines (65536), with no line terminators
|
dropped
|
||
|
C:\Users\Public\alpha.exe
|
PE32+ executable (console) x86-64, for MS Windows
|
modified
|
||
|
C:\Users\Public\kn.exe
|
PE32+ executable (console) x86-64, for MS Windows
|
modified
|
||
|
\Device\Null
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\cmd.exe
|
C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Xirnkxhvuzwepe.cmd" "
|
|
|
|
C:\Windows\System32\extrac32.exe
|
C:\\Windows\\System32\\extrac32 /C /Y C:\\Windows\\System32\\cmd.exe "C:\\Users\\Public\\alpha.exe"
|
|
|
|
C:\Users\Public\alpha.exe
|
C:\\Users\\Public\\alpha /c extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
|
|
|
|
C:\Windows\System32\extrac32.exe
|
extrac32 /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe
|
|
|
|
C:\Users\Public\alpha.exe
|
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Xirnkxhvuzwepe.cmd" "C:\\Users\\Public\\CLEAN.GIF"
3
|
|
|
|
C:\Users\Public\kn.exe
|
C:\\Users\\Public\\kn -decodehex -F "C:\Users\user\Desktop\Xirnkxhvuzwepe.cmd" "C:\\Users\\Public\\CLEAN.GIF" 3
|
|
|
|
C:\Users\Public\alpha.exe
|
C:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\CLEAN.GIF" "C:\\Users\\Public\\Libraries\\CLEAN.COM"
10
|
|
|
|
C:\Users\Public\kn.exe
|
C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\CLEAN.GIF" "C:\\Users\\Public\\Libraries\\CLEAN.COM" 10
|
|
|
|
C:\Users\Public\alpha.exe
|
C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\kn.exe" / A / F / Q / S
|
|
|
|
C:\Users\Public\alpha.exe
|
C:\\Users\\Public\\alpha /c del /q "C:\Users\Public\CLEAN.GIF" / A / F / Q / S
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
There are 1 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://%ws/%ws_%ws_%ws/service.svc/%wsADPolicyProviderSCEP
|
unknown
|
||
|
https://enterpriseregistration.windows.net/EnrollmentServer/DeviceEnrollmentWebService.svc
|
unknown
|
||
|
https://login.microsoftonline.com/%s/oauth2/authorize
|
unknown
|
||
|
https://login.microsoftonline.com/%s/oauth2/token
|
unknown
|
||
|
https://login.microsoftonline.com/%s/oauth2/authorizeJoinStatusStorage::SetDefaultDiscoveryMetadatah
|
unknown
|
||
|
https://%ws/%ws_%ws_%ws/service.svc/%ws
|
unknown
|
||
|
https://enterpriseregistration.windows.net/EnrollmentServer/device/
|
unknown
|
||
|
https://enterpriseregistration.windows.net/EnrollmentServer/key/
|
unknown
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7
|
Name
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
7FF6EB171000
|
unkown
|
page execute read
|
||
|
196C05EB000
|
heap
|
page read and write
|
||
|
1F8EDBE000
|
stack
|
page read and write
|
||
|
196C05DA000
|
heap
|
page read and write
|
||
|
7FF6EB1BF000
|
unkown
|
page read and write
|
||
|
7FF6EB1C9000
|
unkown
|
page readonly
|
||
|
196C05D6000
|
heap
|
page read and write
|
||
|
1BC4D690000
|
heap
|
page read and write
|
||
|
2052A537000
|
heap
|
page read and write
|
||
|
7FF6EB170000
|
unkown
|
page readonly
|
||
|
AF6667C000
|
stack
|
page read and write
|
||
|
2334C1C0000
|
heap
|
page read and write
|
||
|
7FF7FD928000
|
unkown
|
page readonly
|
||
|
7FF6EB1A2000
|
unkown
|
page readonly
|
||
|
196C07C0000
|
heap
|
page read and write
|
||
|
7FF6EB1CC000
|
unkown
|
page write copy
|
||
|
68010FE000
|
stack
|
page read and write
|
||
|
6800DBC000
|
stack
|
page read and write
|
||
|
7FF6EB171000
|
unkown
|
page execute read
|
||
|
2334C1F4000
|
heap
|
page read and write
|
||
|
AF6677F000
|
stack
|
page read and write
|
||
|
7FF6EB1A2000
|
unkown
|
page readonly
|
||
|
196C05DA000
|
heap
|
page read and write
|
||
|
7FF7FD790000
|
unkown
|
page readonly
|
||
|
7FF6EB171000
|
unkown
|
page execute read
|
||
|
23D99AC0000
|
heap
|
page read and write
|
||
|
7FF6EB170000
|
unkown
|
page readonly
|
||
|
2334A420000
|
heap
|
page read and write
|
||
|
77EBB7E000
|
stack
|
page read and write
|
||
|
2334A340000
|
heap
|
page read and write
|
||
|
21836326000
|
heap
|
page read and write
|
||
|
26B7D920000
|
heap
|
page read and write
|
||
|
1BC4D4AB000
|
heap
|
page read and write
|
||
|
7FF6EB1A2000
|
unkown
|
page readonly
|
||
|
7FF6EB1CD000
|
unkown
|
page readonly
|
||
|
2052A537000
|
heap
|
page read and write
|
||
|
7FF6EB1A2000
|
unkown
|
page readonly
|
||
|
196C2610000
|
trusted library allocation
|
page read and write
|
||
|
26B7D8D0000
|
heap
|
page read and write
|
||
|
77EB7DB000
|
stack
|
page read and write
|
||
|
196C0624000
|
heap
|
page read and write
|
||
|
26B7F8D0000
|
heap
|
page read and write
|
||
|
2052A6B0000
|
heap
|
page read and write
|
||
|
22F59460000
|
heap
|
page read and write
|
||
|
7FF6EB1CD000
|
unkown
|
page readonly
|
||
|
22F59450000
|
heap
|
page read and write
|
||
|
2334A554000
|
heap
|
page read and write
|
||
|
218365A0000
|
heap
|
page read and write
|
||
|
7FF7FD91D000
|
unkown
|
page readonly
|
||
|
12CA63F0000
|
heap
|
page read and write
|
||
|
EEF1FF000
|
stack
|
page read and write
|
||
|
23D99AA0000
|
heap
|
page read and write
|
||
|
1F8ED3F000
|
stack
|
page read and write
|
||
|
196C05F4000
|
heap
|
page read and write
|
||
|
218362F3000
|
heap
|
page read and write
|
||
|
AE354FF000
|
stack
|
page read and write
|
||
|
546D7FF000
|
stack
|
page read and write
|
||
|
7FF6EB171000
|
unkown
|
page execute read
|
||
|
7FF6EB170000
|
unkown
|
page readonly
|
||
|
2052A537000
|
heap
|
page read and write
|
||
|
196C05D3000
|
heap
|
page read and write
|
||
|
7FF6EB1CD000
|
unkown
|
page readonly
|
||
|
1BC4D4C3000
|
heap
|
page read and write
|
||
|
218365A4000
|
heap
|
page read and write
|
||
|
7FF6EB1AD000
|
unkown
|
page write copy
|
||
|
196C05F4000
|
heap
|
page read and write
|
||
|
7FF7FD90A000
|
unkown
|
page write copy
|
||
|
7FF7FD8AE000
|
unkown
|
page readonly
|
||
|
26B7D910000
|
heap
|
page read and write
|
||
|
7FF6EB1C9000
|
unkown
|
page readonly
|
||
|
2052A51B000
|
heap
|
page read and write
|
||
|
2183633C000
|
heap
|
page read and write
|
||
|
2052A3A0000
|
heap
|
page read and write
|
||
|
2183635B000
|
heap
|
page read and write
|
||
|
2334A560000
|
heap
|
page read and write
|
||
|
7FF7FD8AE000
|
unkown
|
page readonly
|
||
|
7FF6EB171000
|
unkown
|
page execute read
|
||
|
2052A4A0000
|
heap
|
page read and write
|
||
|
196C0934000
|
heap
|
page read and write
|
||
|
22F596B0000
|
heap
|
page read and write
|
||
|
7FF6EB170000
|
unkown
|
page readonly
|
||
|
7FF7FD90A000
|
unkown
|
page write copy
|
||
|
21836358000
|
heap
|
page read and write
|
||
|
2183634E000
|
heap
|
page read and write
|
||
|
1BC4D480000
|
heap
|
page read and write
|
||
|
2052A6B5000
|
heap
|
page read and write
|
||
|
12CA63D0000
|
heap
|
page read and write
|
||
|
7FF6EB171000
|
unkown
|
page execute read
|
||
|
23D999C7000
|
heap
|
page read and write
|
||
|
12CA6415000
|
heap
|
page read and write
|
||
|
7FF7FD90A000
|
unkown
|
page write copy
|
||
|
7FF7FD90A000
|
unkown
|
page write copy
|
||
|
7FF6EB1CC000
|
unkown
|
page write copy
|
||
|
2334C6DF000
|
heap
|
page read and write
|
||
|
21836337000
|
heap
|
page read and write
|
||
|
7FF6EB1B1000
|
unkown
|
page read and write
|
||
|
2052A6C0000
|
heap
|
page read and write
|
||
|
21836326000
|
heap
|
page read and write
|
||
|
7FF7FD8AE000
|
unkown
|
page readonly
|
||
|
7FF6EB170000
|
unkown
|
page readonly
|
||
|
7FF6EB1C4000
|
unkown
|
page read and write
|
||
|
7FF6EB171000
|
unkown
|
page execute read
|
||
|
680117D000
|
stack
|
page read and write
|
||
|
43E20FC000
|
stack
|
page read and write
|
||
|
2334A550000
|
heap
|
page read and write
|
||
|
2052A534000
|
heap
|
page read and write
|
||
|
7FF6EB1AD000
|
unkown
|
page write copy
|
||
|
2334A427000
|
heap
|
page read and write
|
||
|
7FF6EB1A2000
|
unkown
|
page readonly
|
||
|
7FF6EB1B1000
|
unkown
|
page read and write
|
||
|
7FF6EB1B1000
|
unkown
|
page read and write
|
||
|
43E22FF000
|
stack
|
page read and write
|
||
|
12CA61E0000
|
heap
|
page read and write
|
||
|
2052A6B4000
|
heap
|
page read and write
|
||
|
196C093C000
|
heap
|
page read and write
|
||
|
196C05E6000
|
heap
|
page read and write
|
||
|
26B7D914000
|
heap
|
page read and write
|
||
|
7FF7FD914000
|
unkown
|
page write copy
|
||
|
7FF6EB1CD000
|
unkown
|
page readonly
|
||
|
23D999C2000
|
heap
|
page read and write
|
||
|
2334C625000
|
heap
|
page read and write
|
||
|
2052A537000
|
heap
|
page read and write
|
||
|
7FF6EB1AD000
|
unkown
|
page read and write
|
||
|
2334C20A000
|
heap
|
page read and write
|
||
|
196C060F000
|
heap
|
page read and write
|
||
|
21837FF0000
|
heap
|
page read and write
|
||
|
FE6359C000
|
stack
|
page read and write
|
||
|
196C05F4000
|
heap
|
page read and write
|
||
|
21836310000
|
heap
|
page read and write
|
||
|
196C07A0000
|
heap
|
page read and write
|
||
|
7FF7FD918000
|
unkown
|
page read and write
|
||
|
21838110000
|
trusted library allocation
|
page read and write
|
||
|
7FF6EB1BF000
|
unkown
|
page read and write
|
||
|
26B7D8A0000
|
heap
|
page read and write
|
||
|
7FF6EB1BF000
|
unkown
|
page read and write
|
||
|
196C060C000
|
heap
|
page read and write
|
||
|
12CA6410000
|
heap
|
page read and write
|
||
|
196C060C000
|
heap
|
page read and write
|
||
|
23D999A7000
|
heap
|
page read and write
|
||
|
7FF6EB171000
|
unkown
|
page execute read
|
||
|
2052A537000
|
heap
|
page read and write
|
||
|
7FF7FD928000
|
unkown
|
page readonly
|
||
|
43E21FF000
|
stack
|
page read and write
|
||
|
EEF0FE000
|
stack
|
page read and write
|
||
|
1BC4D460000
|
heap
|
page read and write
|
||
|
22F59506000
|
heap
|
page read and write
|
||
|
21836373000
|
heap
|
page read and write
|
||
|
7FF6EB1B9000
|
unkown
|
page read and write
|
||
|
2334C612000
|
heap
|
page read and write
|
||
|
196C0930000
|
heap
|
page read and write
|
||
|
7FF7FD790000
|
unkown
|
page readonly
|
||
|
21836319000
|
heap
|
page read and write
|
||
|
2183632A000
|
heap
|
page read and write
|
||
|
7FF6EB1A2000
|
unkown
|
page readonly
|
||
|
7FF7FD925000
|
unkown
|
page write copy
|
||
|
7FF6EB1BF000
|
unkown
|
page read and write
|
||
|
7FF6EB1AD000
|
unkown
|
page read and write
|
||
|
26B7D9A9000
|
heap
|
page read and write
|
||
|
7FF6EB1C4000
|
unkown
|
page read and write
|
||
|
21836323000
|
heap
|
page read and write
|
||
|
7FF6EB1AD000
|
unkown
|
page write copy
|
||
|
7FF6EB170000
|
unkown
|
page readonly
|
||
|
2183634E000
|
heap
|
page read and write
|
||
|
546D34B000
|
stack
|
page read and write
|
||
|
7FF6EB1C9000
|
unkown
|
page readonly
|
||
|
1BC4D485000
|
heap
|
page read and write
|
||
|
196C05DA000
|
heap
|
page read and write
|
||
|
7FF7FD91D000
|
unkown
|
page readonly
|
||
|
21836373000
|
heap
|
page read and write
|
||
|
2334A520000
|
heap
|
page read and write
|
||
|
2183632A000
|
heap
|
page read and write
|
||
|
7FF7FD925000
|
unkown
|
page write copy
|
||
|
7FF6EB1C9000
|
unkown
|
page readonly
|
||
|
7FF6EB1C9000
|
unkown
|
page readonly
|
||
|
2052A480000
|
heap
|
page read and write
|
||
|
1BC4D4A0000
|
heap
|
page read and write
|
||
|
7FF7FD918000
|
unkown
|
page read and write
|
||
|
26B7F704000
|
heap
|
page read and write
|
||
|
7FF6EB1C9000
|
unkown
|
page readonly
|
||
|
7FF6EB1A2000
|
unkown
|
page readonly
|
||
|
22F59506000
|
heap
|
page read and write
|
||
|
196C060C000
|
heap
|
page read and write
|
||
|
12CA61E7000
|
heap
|
page read and write
|
||
|
1F8ECBB000
|
stack
|
page read and write
|
||
|
196C06C0000
|
heap
|
page read and write
|
||
|
7FF6EB1AD000
|
unkown
|
page write copy
|
||
|
26B7F816000
|
heap
|
page read and write
|
||
|
7FF6EB1AD000
|
unkown
|
page read and write
|
||
|
1BC4D670000
|
heap
|
page read and write
|
||
|
22F59506000
|
heap
|
page read and write
|
||
|
7FF7FD790000
|
unkown
|
page readonly
|
||
|
23D99BF4000
|
heap
|
page read and write
|
||
|
7FF6EB1CC000
|
unkown
|
page write copy
|
||
|
2334C521000
|
heap
|
page read and write
|
||
|
196C05E7000
|
heap
|
page read and write
|
||
|
7FF6EB1B9000
|
unkown
|
page read and write
|
||
|
AE352FC000
|
stack
|
page read and write
|
||
|
77EBAFE000
|
stack
|
page read and write
|
||
|
2052A510000
|
heap
|
page read and write
|
||
|
7FF7FD928000
|
unkown
|
page readonly
|
||
|
546D6FF000
|
stack
|
page read and write
|
||
|
12CA61EE000
|
heap
|
page read and write
|
||
|
7FF6EB1C9000
|
unkown
|
page readonly
|
||
|
2183635B000
|
heap
|
page read and write
|
||
|
7FF7FD790000
|
unkown
|
page readonly
|
||
|
7FF6EB1A2000
|
unkown
|
page readonly
|
||
|
7FF6EB1C9000
|
unkown
|
page readonly
|
||
|
7FF7FD926000
|
unkown
|
page readonly
|
||
|
7FF6EB1A2000
|
unkown
|
page readonly
|
||
|
196C05EB000
|
heap
|
page read and write
|
||
|
196C0609000
|
heap
|
page read and write
|
||
|
23D999A0000
|
heap
|
page read and write
|
||
|
196C0880000
|
heap
|
page read and write
|
||
|
7FF7FD928000
|
unkown
|
page readonly
|
||
|
680107E000
|
stack
|
page read and write
|
||
|
7FF6EB1BF000
|
unkown
|
page read and write
|
||
|
22F594A0000
|
heap
|
page read and write
|
||
|
196C0840000
|
heap
|
page read and write
|
||
|
23D99BF5000
|
heap
|
page read and write
|
||
|
22F594E0000
|
heap
|
page read and write
|
||
|
1BC4D484000
|
heap
|
page read and write
|
||
|
7FF7FD914000
|
unkown
|
page write copy
|
||
|
7FF6EB171000
|
unkown
|
page execute read
|
||
|
2183634D000
|
heap
|
page read and write
|
||
|
22F59503000
|
heap
|
page read and write
|
||
|
7FF6EB1A2000
|
unkown
|
page readonly
|
||
|
7FF7FD791000
|
unkown
|
page execute read
|
||
|
7FF6EB1B5000
|
unkown
|
page read and write
|
||
|
7FF6EB1CC000
|
unkown
|
page write copy
|
||
|
7FF7FD913000
|
unkown
|
page read and write
|
||
|
2334C070000
|
heap
|
page read and write
|
||
|
AF666FD000
|
stack
|
page read and write
|
||
|
196C0883000
|
heap
|
page read and write
|
||
|
7FF6EB1B1000
|
unkown
|
page read and write
|
||
|
2183635B000
|
heap
|
page read and write
|
||
|
7FF6EB171000
|
unkown
|
page execute read
|
||
|
26B7D7C0000
|
heap
|
page read and write
|
||
|
7FF7FD913000
|
unkown
|
page read and write
|
||
|
23D998C0000
|
heap
|
page read and write
|
||
|
2052A537000
|
heap
|
page read and write
|
||
|
196C05D6000
|
heap
|
page read and write
|
||
|
218362F0000
|
heap
|
page read and write
|
||
|
EEEDEC000
|
stack
|
page read and write
|
||
|
21836270000
|
heap
|
page read and write
|
||
|
218365AC000
|
heap
|
page read and write
|
||
|
2183633D000
|
heap
|
page read and write
|
||
|
196C05C9000
|
heap
|
page read and write
|
||
|
7FF7FD91D000
|
unkown
|
page readonly
|
||
|
7FF6EB1C9000
|
unkown
|
page readonly
|
||
|
7FF7FD791000
|
unkown
|
page execute read
|
||
|
7FF6EB170000
|
unkown
|
page readonly
|
||
|
23D99AE0000
|
heap
|
page read and write
|
||
|
1BC4D450000
|
heap
|
page read and write
|
||
|
7FF7FD91D000
|
unkown
|
page readonly
|
||
|
7FF6EB170000
|
unkown
|
page readonly
|
||
|
21836250000
|
heap
|
page read and write
|
||
|
2183632A000
|
heap
|
page read and write
|
||
|
196C060C000
|
heap
|
page read and write
|
||
|
26B7F803000
|
heap
|
page read and write
|
||
|
FE639FF000
|
stack
|
page read and write
|
||
|
7FF7FD791000
|
unkown
|
page execute read
|
||
|
7FF7FD8AE000
|
unkown
|
page readonly
|
||
|
26B7F712000
|
heap
|
page read and write
|
||
|
FE638FF000
|
stack
|
page read and write
|
||
|
77EBA7E000
|
stack
|
page read and write
|
||
|
21838910000
|
heap
|
page read and write
|
||
|
22F59480000
|
heap
|
page read and write
|
||
|
12CA6207000
|
heap
|
page read and write
|
||
|
12CA6420000
|
heap
|
page read and write
|
||
|
21836338000
|
heap
|
page read and write
|
||
|
7FF6EB170000
|
unkown
|
page readonly
|
||
|
7FF6EB1AD000
|
unkown
|
page read and write
|
||
|
7FF6EB1CC000
|
unkown
|
page write copy
|
||
|
12CA6414000
|
heap
|
page read and write
|
||
|
21836170000
|
heap
|
page read and write
|
||
|
7FF6EB1AD000
|
unkown
|
page read and write
|
||
|
AE353FE000
|
stack
|
page read and write
|
||
|
196C2E10000
|
heap
|
page read and write
|
||
|
7FF6EB1CD000
|
unkown
|
page readonly
|
||
|
196C05C0000
|
heap
|
page read and write
|
||
|
22F594EB000
|
heap
|
page read and write
|
||
|
7FF6EB1AD000
|
unkown
|
page write copy
|
||
|
2334C1F0000
|
heap
|
page read and write
|
||
|
7FF6EB1C9000
|
unkown
|
page readonly
|
||
|
26B7D9A0000
|
heap
|
page read and write
|
||
|
26B7F600000
|
heap
|
page read and write
|
||
|
1F8F07E000
|
stack
|
page read and write
|
||
|
7FF7FD926000
|
unkown
|
page readonly
|
||
|
7FF6EB1B1000
|
unkown
|
page read and write
|
||
|
26B7F700000
|
heap
|
page read and write
|
||
|
12CA62F0000
|
heap
|
page read and write
|
||
|
22F594A4000
|
heap
|
page read and write
|
||
|
7FF6EB170000
|
unkown
|
page readonly
|
||
|
22F594A5000
|
heap
|
page read and write
|
||
|
12CA6203000
|
heap
|
page read and write
|
||
|
7FF7FD791000
|
unkown
|
page execute read
|
||
|
23D99BF0000
|
heap
|
page read and write
|
||
|
2052A537000
|
heap
|
page read and write
|
There are 288 hidden memdumps, click here to show them.