6c1468d28ac3c0ada79124e3a76315dc063baa891793ca145621fc54f243448c | Triage

Analysis

max time kernel
157s
max time network
215s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 21:48 UTC

Sharing

Report Analysis Logs

General

Target

ZealotAllideoConverter/All Video Converter/金山毒霸2007 无限升级版.url
Size

398B
MD5

fe8e1d149555fcc1210f321e01af3d25
SHA1

be5fb61cf73aea32c0bccb455d4c9bad37df4a64
SHA256

d1d466c78f3bb766fa5fe41b9118342f18895250dcae119cc782a86252802a39
SHA512

b05ab97921509b66bf41ffe97a7035f84d069ccf6add80433eee67eb61b8e25958098d61bb7f3e56659108efd904a406ab29d0a73b3ec89ff305f0967ef80ad4

Score

1^/10

Malware Config

Signatures

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL "C:\Users\Admin\AppData\Local\Temp\ZealotAllideoConverter\All Video Converter\金山毒霸2007 无限升级版.url"
1⤵
PID:1272

Network

DNS

96.108.152.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

96.108.152.52.in-addr.arpa

IN PTR

Response
DNS

9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.3.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa

Remote address:

8.8.8.8:53

Request

9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.3.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa

IN PTR

Response

72.21.81.240:80

322 B
7
72.21.81.240:80

322 B
7
104.80.225.205:443

322 B
7
20.50.73.10:443

322 B
7
96.16.53.137:80

322 B
7
96.16.53.137:80

322 B
7
96.16.53.137:80

322 B
7
20.54.89.15:443

260 B
5

8.8.8.8:53

96.108.152.52.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

96.108.152.52.in-addr.arpa
8.8.8.8:53

9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.3.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa

dns

118 B
204 B
1
1

DNS Request

9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.3.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads