Analysis
-
max time kernel
446s -
max time network
450s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
-
submitted
11/05/2024, 09:01 UTC
General
-
Target
ZHacks____SolaraBETA3/Monaco/fileaccess/node_modules/depd/index.js
-
Size
10KB
-
MD5
002a1f3e813cc05d9e3cc011f6601628
-
SHA1
1690c27457637ec234d6b7658f1b96e547a0eb99
-
SHA256
4d587a5662e20a7bb9bfe6555afe5987e1b80303a819b447394f37a93297ee91
-
SHA512
ea1ad9bcf09a73a10dd1fd8a66daac12f87725e16ad27e7beff6d9fda937579976cd5d7ed6439c4122b16178c3ffdf410d6c7a54918f94bc98fa7950adf3bd54
-
SSDEEP
192:vpe1221Fdc5jXmXUApvcvcBGtXY/KQYbUY/rRgrNoYo8GVHXWVhVO:vpe191Lc5G0k//YsNIVHXWVhVO
Score
3/10
Malware Config
Signatures
-
Command and Scripting Interpreter: JavaScript 1 TTPs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\ZHacks____SolaraBETA3\Monaco\fileaccess\node_modules\depd\index.js1⤵
Network
-
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle -
DNSself.events.data.microsoft.comRemote address:8.8.8.8:53Requestself.events.data.microsoft.comIN AResponseself.events.data.microsoft.comIN CNAMEself-events-data.trafficmanager.netself-events-data.trafficmanager.netIN CNAMEonedscolprdcus20.centralus.cloudapp.azure.comonedscolprdcus20.centralus.cloudapp.azure.comIN A104.208.16.95
-
DNSctldl.windowsupdate.comRemote address:8.8.8.8:53Requestctldl.windowsupdate.comIN AResponsectldl.windowsupdate.comIN CNAMEctldl.windowsupdate.com.delivery.microsoft.comctldl.windowsupdate.com.delivery.microsoft.comIN CNAMEwu-b-net.trafficmanager.netwu-b-net.trafficmanager.netIN CNAMEedge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.comedge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.comIN A217.20.56.37edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.comIN A217.20.58.99edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.comIN A217.20.58.101edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.comIN A217.20.58.98edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.comIN A217.20.56.34edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.comIN A217.20.58.100edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.comIN A217.20.56.98
-
DNSctldl.windowsupdate.comRemote address:8.8.8.8:53Requestctldl.windowsupdate.comIN AResponsectldl.windowsupdate.comIN CNAMEctldl.windowsupdate.com.delivery.microsoft.comctldl.windowsupdate.com.delivery.microsoft.comIN CNAMEwu-b-net.trafficmanager.netwu-b-net.trafficmanager.netIN CNAMEdownload.windowsupdate.com.edgesuite.netdownload.windowsupdate.com.edgesuite.netIN CNAMEa767.dspw65.akamai.neta767.dspw65.akamai.netIN A2.18.190.77a767.dspw65.akamai.netIN A2.18.190.79
No results found
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
DNS Request
self.events.data.microsoft.com
DNS Response
104.208.16.95
DNS Request
ctldl.windowsupdate.com
DNS Response
217.20.56.37217.20.58.99217.20.58.101217.20.58.98217.20.56.34217.20.58.100217.20.56.98
DNS Request
ctldl.windowsupdate.com
DNS Response
2.18.190.772.18.190.79