General
-
Target
39d174e6804c39591668d4e999341c14692f570e76afb1a0eafca31b04e301fc
-
Size
273KB
-
Sample
220201-vwlknaace8
-
MD5
e7df91ac5f161f54e3fafe18e92f528b
-
SHA1
b441934c695c87b462cc27dbce9910bfec8b7b61
-
SHA256
39d174e6804c39591668d4e999341c14692f570e76afb1a0eafca31b04e301fc
-
SHA512
6c3511be6abdcec26f22af4f5cdab818f00e9108802106874c6c8c25cf0d4a886ded1d0f17531535d60d15ef7f4bfb5e7c04dbe7599ca75abf7c7a846c3db091
Static task
static1
Behavioral task
behavioral1
Sample
39d174e6804c39591668d4e999341c14692f570e76afb1a0eafca31b04e301fc.ps1
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
39d174e6804c39591668d4e999341c14692f570e76afb1a0eafca31b04e301fc.ps1
Resource
win10v2004-en-20220112
Malware Config
Extracted
cobaltstrike
1359593325
http://173.234.155.223:80/boxes.css
-
access_type
512
-
host
173.234.155.223,/boxes.css
-
http_header1
AAAAEAAAABtIb3N0OiBzeW1hbnRlY3NlY3VyaXR5dC5jb20AAAAKAAAAEUNvbm5lY3Rpb246IGNsb3NlAAAACgAAABJBY2NlcHQ6IGltYWdlL2pwZWcAAAAHAAAAAAAAAAsAAAADAAAAAgAAADV3b3JkcHJlc3NfbG9nZ2VkX2luXzE4NzBhODI5ZDliYzY5YWJmNTAwZWNhNmYwMDI0MWZlPQAAAAYAAAAGQ29va2llAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAAEAAAABtIb3N0OiBzeW1hbnRlY3NlY3VyaXR5dC5jb20AAAAKAAAAEUNvbm5lY3Rpb246IGNsb3NlAAAACgAAABVBY2NlcHQtRW5jb2Rpbmc6IGd6aXAAAAAKAAAAL0NvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkAAAABwAAAAEAAAAPAAAAAwAAAAIAAAAHYnJva2VuPQAAAAQAAAAHAAAAAAAAAAMAAAACAAAADl9fc2Vzc2lvbl9faWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
11008
-
polling_time
61757
-
port_number
80
-
sc_process32
%windir%\syswow64\WUAUCLT.exe
-
sc_process64
%windir%\sysnative\WUAUCLT.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJvC2CQYaIouT41kXKVNrM5lLvclGJRE+i3ves+vC0AADUWTPs64Dn/B4eKlQKPpbC/8IgJjadD/B9pZiY8XUlk4dvaagLdjBCq7uSxS+KhVVsX46LBSBgIxaE4AeoZvwBD2n0wdeeI2sbkMvDhhv5s6Nmz12sAtOVGdr8cX3s5QIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
2.708806656e+09
-
unknown2
AAAABAAAAAIAAAPVAAAAAwAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/ce
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246
-
watermark
1359593325
Targets
-
-
Target
39d174e6804c39591668d4e999341c14692f570e76afb1a0eafca31b04e301fc
-
Size
273KB
-
MD5
e7df91ac5f161f54e3fafe18e92f528b
-
SHA1
b441934c695c87b462cc27dbce9910bfec8b7b61
-
SHA256
39d174e6804c39591668d4e999341c14692f570e76afb1a0eafca31b04e301fc
-
SHA512
6c3511be6abdcec26f22af4f5cdab818f00e9108802106874c6c8c25cf0d4a886ded1d0f17531535d60d15ef7f4bfb5e7c04dbe7599ca75abf7c7a846c3db091
Score10/10-
Blocklisted process makes network request
-