Malware Analysis Report

2024-12-07 02:10

Sample ID 241115-t21q4axgkj
Target 4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe
SHA256 4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373
Tags
upx mydoom discovery persistence worm microsoft phishing product:outlook
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373

Threat Level: Known bad

The file 4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe was found to be: Known bad.

Malicious Activity Summary

upx mydoom discovery persistence worm microsoft phishing product:outlook

MyDoom

Detected microsoft outlook phishing page

Detects MyDoom family

Mydoom family

Executes dropped EXE

Adds Run key to start application

UPX packed file

Drops file in Windows directory

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-15 16:33

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-15 16:33

Reported

2024-11-15 16:35

Platform

win7-20241010-en

Max time kernel

120s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe"

Signatures

Detects MyDoom family

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

MyDoom

worm mydoom

Mydoom family

mydoom

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\services.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe

"C:\Users\Admin\AppData\Local\Temp\4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
N/A 10.156.133.4:1034 tcp
N/A 172.16.1.5:1034 tcp
N/A 172.16.1.2:1034 tcp
N/A 192.168.17.106:1034 tcp
N/A 10.222.21.129:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 8.8.8.8:53 gzip.org udp
US 52.101.8.51:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 gzip.org udp
US 85.187.148.2:25 gzip.org tcp
N/A 172.16.1.188:1034 tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 204.13.239.180:25 alumni.caltech.edu tcp
US 85.187.148.2:25 gzip.org tcp

Files

memory/2136-2-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2136-4-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/308-10-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2136-16-0x0000000000500000-0x0000000000510200-memory.dmp

memory/2136-17-0x0000000000400000-0x0000000000408000-memory.dmp

memory/308-19-0x0000000000400000-0x0000000000408000-memory.dmp

memory/308-20-0x0000000000400000-0x0000000000408000-memory.dmp

memory/308-25-0x0000000000400000-0x0000000000408000-memory.dmp

memory/308-30-0x0000000000400000-0x0000000000408000-memory.dmp

memory/308-32-0x0000000000400000-0x0000000000408000-memory.dmp

memory/308-37-0x0000000000400000-0x0000000000408000-memory.dmp

memory/308-42-0x0000000000400000-0x0000000000408000-memory.dmp

memory/308-44-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2136-48-0x0000000000500000-0x0000000000510200-memory.dmp

memory/308-49-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2136-53-0x0000000000500000-0x0000000000510200-memory.dmp

memory/308-54-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 7d4c6e9ee3424af9c91804d4c7ce3890
SHA1 5fe316400aac92817bdf0da38d683a43b9be6d66
SHA256 fb65dd664d9875200cd48160e380774f9b03b049d18fc6aad1fd11165ecedd1d
SHA512 5ed539722bb590dd5db7773878e15b53bf97135c2cdc112a967d1aa4ae19196b89a97a55c149ee5ad165c729d6136e2e5463b423bc76af2bfe29ebce7731ba0f

C:\Users\Admin\AppData\Local\Temp\tmp52E3.tmp

MD5 5dbe472fb6c409dce25cd2b964ceddd7
SHA1 181793ecefe6971202a1e23741e49b968f8dc573
SHA256 7859b08ffbaf13c8aed86adfd8a48040bbf558d0d4ecce5223c88f7f3e4fefda
SHA512 a6b7bff702f40dd98549fbce7d2376a5903f9c52805674d575464ce1c1e2245c11b7f0fd29211902cf9fa4fb0a91d045f4c1d8b62699222ff93814a3b007d431

memory/2136-72-0x0000000000500000-0x0000000000510200-memory.dmp

memory/308-73-0x0000000000400000-0x0000000000408000-memory.dmp

memory/2136-76-0x0000000000500000-0x0000000000510200-memory.dmp

memory/308-77-0x0000000000400000-0x0000000000408000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-15 16:33

Reported

2024-11-15 16:36

Platform

win10v2004-20241007-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe"

Signatures

Detected microsoft outlook phishing page

phishing microsoft product:outlook

Detects MyDoom family

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

MyDoom

worm mydoom

Mydoom family

mydoom

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\services.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" C:\Users\Admin\AppData\Local\Temp\4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" C:\Windows\services.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\services.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe

"C:\Users\Admin\AppData\Local\Temp\4ae4ab6373a126fec6ea75014ab74de8c69dc7af3a5d39b16743864e03d2f373.exe"

C:\Windows\services.exe

"C:\Windows\services.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
N/A 10.156.133.4:1034 tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
N/A 172.16.1.5:1034 tcp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
N/A 172.16.1.2:1034 tcp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
N/A 192.168.17.106:1034 tcp
US 8.8.8.8:53 m-ou.se udp
US 8.8.8.8:53 aspmx3.googlemail.com udp
DE 142.251.9.26:25 aspmx3.googlemail.com tcp
US 8.8.8.8:53 acm.org udp
US 8.8.8.8:53 mail.mailroute.net udp
US 199.89.3.120:25 mail.mailroute.net tcp
US 8.8.8.8:53 cs.stanford.edu udp
US 8.8.8.8:53 smtp1.cs.stanford.edu udp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 mx.burtleburtle.net udp
US 65.254.254.50:25 mx.burtleburtle.net tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 8.8.8.8:53 alumni-caltech-edu.mail.protection.outlook.com udp
US 52.101.11.13:25 alumni-caltech-edu.mail.protection.outlook.com tcp
US 8.8.8.8:53 gzip.org udp
US 8.8.8.8:53 gzip.org udp
US 85.187.148.2:25 gzip.org tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 search.yahoo.com udp
GB 172.217.16.228:80 www.google.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
GB 172.217.16.228:80 www.google.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
IE 212.82.100.137:80 search.yahoo.com tcp
IE 212.82.100.137:443 search.yahoo.com tcp
US 8.8.8.8:53 228.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 137.100.82.212.in-addr.arpa udp
US 8.8.8.8:53 search.lycos.com udp
GB 172.217.16.228:80 www.google.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 8.8.8.8:53 www.altavista.com udp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 r11.o.lencr.org udp
GB 2.18.190.80:80 r11.o.lencr.org tcp
GB 172.217.16.228:80 www.google.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 8.8.8.8:53 10.254.202.209.in-addr.arpa udp
US 8.8.8.8:53 61.45.26.184.in-addr.arpa udp
US 8.8.8.8:53 80.190.18.2.in-addr.arpa udp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 172.217.16.228:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
GB 172.217.16.228:80 www.google.com tcp
GB 172.217.16.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
N/A 10.222.21.129:1034 tcp
US 8.8.8.8:53 aspmx2.googlemail.com udp
NL 142.250.153.27:25 aspmx2.googlemail.com tcp
US 8.8.8.8:53 acm.org udp
US 104.17.78.30:25 acm.org tcp
US 8.8.8.8:53 smtp2.cs.stanford.edu udp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 burtleburtle.net udp
US 65.254.227.224:25 burtleburtle.net tcp
US 8.8.8.8:53 alumni.caltech.edu udp
US 204.13.239.180:25 alumni.caltech.edu tcp
US 85.187.148.2:25 gzip.org tcp
US 171.64.64.26:25 smtp2.cs.stanford.edu tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
N/A 172.16.1.188:1034 tcp
US 8.8.8.8:53 aspmx5.googlemail.com udp
SG 74.125.200.27:25 aspmx5.googlemail.com tcp
US 8.8.8.8:53 mx.acm.org udp
US 8.8.8.8:53 mail.acm.org udp
US 8.8.8.8:53 smtp.acm.org udp
US 8.8.8.8:53 cs.stanford.edu udp
US 171.64.64.64:25 cs.stanford.edu tcp
US 65.254.254.50:25 mx.burtleburtle.net tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 171.64.64.25:25 smtp1.cs.stanford.edu tcp
US 8.8.8.8:53 mx.alumni.caltech.edu udp
US 8.8.8.8:53 mx.gzip.org udp
US 8.8.8.8:53 mail.alumni.caltech.edu udp
US 8.8.8.8:53 smtp.alumni.caltech.edu udp
US 8.8.8.8:53 mail.gzip.org udp
US 8.8.8.8:53 outlook.com udp
US 85.187.148.2:25 mail.gzip.org tcp
US 8.8.8.8:53 outlook-com.olc.protection.outlook.com udp
US 52.101.9.27:25 outlook-com.olc.protection.outlook.com tcp
GB 172.217.16.228:80 www.google.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 171.64.64.64:25 cs.stanford.edu tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:80 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 172.217.16.228:80 www.google.com tcp
GB 172.217.16.228:80 www.google.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
GB 172.217.16.228:80 www.google.com tcp
GB 172.217.16.228:80 www.google.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
GB 172.217.16.228:80 www.google.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
GB 172.217.16.228:80 www.google.com tcp
IE 212.82.100.137:80 www.altavista.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:80 search.lycos.com tcp
GB 172.217.16.228:80 www.google.com tcp
US 209.202.254.10:443 search.lycos.com tcp
IE 212.82.100.137:443 www.altavista.com tcp
US 209.202.254.10:443 tcp
IE 212.82.100.137:80 tcp
GB 172.217.16.228:80 tcp
IE 212.82.100.137:443 tcp
GB 172.217.16.228:80 tcp

Files

memory/3576-0-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Windows\services.exe

MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

memory/548-7-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/3576-13-0x0000000000500000-0x0000000000510200-memory.dmp

memory/548-15-0x0000000000400000-0x0000000000408000-memory.dmp

memory/548-16-0x0000000000400000-0x0000000000408000-memory.dmp

memory/548-21-0x0000000000400000-0x0000000000408000-memory.dmp

memory/548-26-0x0000000000400000-0x0000000000408000-memory.dmp

memory/548-28-0x0000000000400000-0x0000000000408000-memory.dmp

memory/548-33-0x0000000000400000-0x0000000000408000-memory.dmp

memory/3576-37-0x0000000000500000-0x0000000000510200-memory.dmp

memory/548-38-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 6f534f1d9b99c25a1130f7ab1dc91025
SHA1 b119bb21b51783484b1c82275edb5b4ff0a99688
SHA256 4d9705b3bffbc561fc7570dbbb2bdc2bbc3e00f31d4764408229719a0a3587ad
SHA512 e8358808726ebe6dfc8b0e993460ced18aeaa9ce31f304764a25a8b349bd36135a20c7307c4a29126ab58149c97d5ecf04c4d6dd8b5f6d2ec0a4de50f058621c

C:\Users\Admin\AppData\Local\Temp\tmpAE6B.tmp

MD5 7d6c29b796222760f10a16a214595b8c
SHA1 d7c38af63ee7754c84ce05b4577bcde4da0a4eea
SHA256 e65b79f29c4acc882ef4515911cfed0c9026ef2780b25a21600dcd39edc701c3
SHA512 236fa43f85f651c656daae7cdb5e98f303e00ab319e20d96c854ba214570a6c74b2b1a359e25b1467d95eaad23175d68c87c546493963f4fbbe1eb78f0462acd

memory/3576-125-0x0000000000500000-0x0000000000510200-memory.dmp

memory/548-126-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H6N4U6J0\MXJ3XM1Y.htm

MD5 0a507e9d41de7777f6cf8ef930b7bf0d
SHA1 c96fa29e640b7f142619397fc8832a14c7cd4cd5
SHA256 035bafa9e612907398fa3142694c3f0f72946b541bd4e4472c006c718f45fd83
SHA512 001dfab8157bb58dc3b851f59450dde8df74a07e5393b2933cc171d6928ae0085e9b200381410a6426f9928597251e7cd4fcf9277d11242b3c5d46a924e171da

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TTJXD3SW\search[3].htm

MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\84KCLP1T\search[3].htm

MD5 79f843fa60c60b247a95c42c7c7dcf66
SHA1 238341cb81d17b5e2ee2faf0a62d88c8c8be7628
SHA256 35461e996e566f72161338c1e9e1231b929d13ad666fc60e403d03ae559b5661
SHA512 31647654545b097e94e3a513c1f6bb0e998ae6f9659d2dccbcac7c241e66cc3273b6e8e2dbbc4dbe2a12e59f0740c51107b0452753774fd8a312d6a0b9d3558e

memory/3576-206-0x0000000000500000-0x0000000000510200-memory.dmp

memory/548-207-0x0000000000400000-0x0000000000408000-memory.dmp

memory/3576-211-0x0000000000500000-0x0000000000510200-memory.dmp

memory/548-212-0x0000000000400000-0x0000000000408000-memory.dmp

memory/548-214-0x0000000000400000-0x0000000000408000-memory.dmp

memory/3576-218-0x0000000000500000-0x0000000000510200-memory.dmp

C:\Users\Admin\AppData\Local\Temp\zincite.log

MD5 811f91fe9381b33342e7b81c6ffebc0d
SHA1 3c655a7c8d1af317a1f703d904a8e40b0820e66d
SHA256 1cbe65d64973ad9d0e2eacd6168ccc37c7cde0220acbad316101dddc6ef7a9ac
SHA512 41dee0f7ccee9e298b84a6a3598a32ac57fca465d71872c9b91cefa0fb36f0bb0b6fd03c93a0610e8cceac3d4fd0821eca98d71d7da1ec2c4275abd9dce76af8

memory/548-233-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TTJXD3SW\search[1].htm

MD5 34aa8a053a3e11cc53bf0f20248e9003
SHA1 c15188ccafc216905c642f53b1d00b6cf1882e84
SHA256 8d462d6cf4e35e1207acebc462c9320caa9e93d89370affd4031762801e84e6d
SHA512 fb13df76024cecb72cf4e77f24eb7a1aa28c5705366108e8ba143da78d17167a99d3e4abc5227e480137cfade1a5c40423c9596d6165477c10aaaa5a4fccfd6c

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\H6N4U6J0\search[2].htm

MD5 fc86ccc04eb29ec00ea0185de02e47af
SHA1 42905420d3f6c177dfa8854403511dd0ad0570fa
SHA256 7691935bb7171451ddb3e4513fb614a4b1ca3f31146db5ec8095f4b97ff450c9
SHA512 4d0528e02f531aa62655fe305ae12e0255d4f2a87b8ffd339e7cd57dc3b55818b25e9c6d4163f4f823253842c460cd4d4a3f02a87d174aef8d43ff230f3d0517