Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2024, 07:37 UTC

General

  • Target

    359489ba5aa39e729841fbe96e65ca0bd5a9e76fbfaa50159e20ea44c28d642d.exe

  • Size

    1.2MB

  • MD5

    b8a57adac9a22b4beca66da7729c60ef

  • SHA1

    775215acdf6b6fb5e0ba283314c94b82ba3661b7

  • SHA256

    359489ba5aa39e729841fbe96e65ca0bd5a9e76fbfaa50159e20ea44c28d642d

  • SHA512

    691c5ebbc4c9b060dfa32037dcb853e6ddd6f6406ff554859c6c2b8f5eef7738e1b55a57c8024ca9dc5584c47bbfa8081db1e3a5a9385404adf3f9148473d963

  • SSDEEP

    24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtiU:WIwgMEuy+inDfp3/XoCw57XYBwKU

Malware Config

Signatures

  • Detect PurpleFox Rootkit 7 IoCs

    Detect PurpleFox Rootkit.

  • Gh0st RAT payload 8 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Gh0strat family
  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

  • Purplefox family
  • Drops file in Drivers directory 1 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 2 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 4 IoCs
  • VMProtect packed file 10 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 8 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\359489ba5aa39e729841fbe96e65ca0bd5a9e76fbfaa50159e20ea44c28d642d.exe
    "C:\Users\Admin\AppData\Local\Temp\359489ba5aa39e729841fbe96e65ca0bd5a9e76fbfaa50159e20ea44c28d642d.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:404
    • C:\Users\Admin\AppData\Local\Temp\AK47.exe
      "C:\Users\Admin\AppData\Local\Temp\AK47.exe"
      2⤵
      • Server Software Component: Terminal Services DLL
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:2784
    • C:\Users\Admin\AppData\Local\Temp\AK47.exe
      C:\Users\Admin\AppData\Local\Temp\\AK47.exe
      2⤵
      • Server Software Component: Terminal Services DLL
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:116
    • C:\Users\Admin\AppData\Local\Temp\AK74.exe
      C:\Users\Admin\AppData\Local\Temp\\AK74.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5072
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\AK74.exe > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:1740
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2792
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1804
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1420
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1548
    • C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      C:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240627593.txt",MainThread
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3964
  • C:\Windows\SysWOW64\Ghiya.exe
    C:\Windows\SysWOW64\Ghiya.exe -auto
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\Windows\SysWOW64\Ghiya.exe
      C:\Windows\SysWOW64\Ghiya.exe -acsi
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Executes dropped EXE
      • Suspicious behavior: LoadsDriver
      • Suspicious use of AdjustPrivilegeToken
      PID:1196

Network

  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    71.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    71.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    56.163.245.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.163.245.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    99.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    99.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
  • flag-us
    DNS
    31.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    31.243.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • flag-us
    DNS
    cf1549064127.f3322.net
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    Remote address:
    8.8.8.8:53
    Request
    cf1549064127.f3322.net
    IN A
    Response
  • 43.249.193.73:54997
    359489ba5aa39e729841fbe96e65ca0bd5a9e76fbfaa50159e20ea44c28d642d.exe
    260 B
    5
  • 43.249.193.73:54997
    359489ba5aa39e729841fbe96e65ca0bd5a9e76fbfaa50159e20ea44c28d642d.exe
    260 B
    5
  • 43.249.193.73:54997
    359489ba5aa39e729841fbe96e65ca0bd5a9e76fbfaa50159e20ea44c28d642d.exe
    260 B
    5
  • 43.249.193.73:54997
    359489ba5aa39e729841fbe96e65ca0bd5a9e76fbfaa50159e20ea44c28d642d.exe
    260 B
    5
  • 43.249.193.73:54997
    359489ba5aa39e729841fbe96e65ca0bd5a9e76fbfaa50159e20ea44c28d642d.exe
    260 B
    5
  • 43.249.193.73:54997
    359489ba5aa39e729841fbe96e65ca0bd5a9e76fbfaa50159e20ea44c28d642d.exe
    260 B
    5
  • 43.249.193.73:54997
    359489ba5aa39e729841fbe96e65ca0bd5a9e76fbfaa50159e20ea44c28d642d.exe
    260 B
    5
  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    71.31.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    71.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    56.163.245.4.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    56.163.245.4.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    99.209.201.84.in-addr.arpa
    dns
    72 B
    132 B
    1
    1

    DNS Request

    99.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    136 B
    129 B
    2
    1

    DNS Request

    cf1549064127.f3322.net

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    31.243.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    31.243.111.52.in-addr.arpa

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    136 B
    258 B
    2
    2

    DNS Request

    cf1549064127.f3322.net

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

  • 8.8.8.8:53
    cf1549064127.f3322.net
    dns
    Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
    68 B
    129 B
    1
    1

    DNS Request

    cf1549064127.f3322.net

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\AK47.exe

    Filesize

    91KB

    MD5

    423eb994ed553294f8a6813619b8da87

    SHA1

    eca6a16ccd13adcfc27bc1041ddef97ec8081255

    SHA256

    050b4f2d5ae8eaecd414318dc8e222a56f169626da6ca8feb7edd78e8b1f0218

    SHA512

    fab0a9af8031c242c486de373df7277c8b0e39f7a0c9c2ac2e385dbd3ea67be16e91b128287634f76131e5264149ab1b452cd21df4c4895e8c4efc8d8cf99095

  • C:\Users\Admin\AppData\Local\Temp\AK74.exe

    Filesize

    400KB

    MD5

    b0998aa7d5071d33daa5b60b9c3c9735

    SHA1

    9365a1ff0c6de244d6f36c8d84072cc916665d3c

    SHA256

    3080b6bb456564899b0d99d4131bd6a0b284d31f7d80ef773e4872d94048d49a

    SHA512

    308c13cda9fea39b980ae686f44afd9090e9cb8970fffc4436320e0d09a31aee5e656914e0121fe888098a14c52749716fa04980396fd6ac70a88c11cbb6b850

  • C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini

    Filesize

    92B

    MD5

    29ce53e2a4a446614ccc8d64d346bde4

    SHA1

    39a7aa5cc1124842aa0c25abb16ea94452125cbe

    SHA256

    56225be6838bc6e93ea215891eacf28844ae27a9f8b2b29bf19d3a8c2b1f58df

    SHA512

    b2c5a2708c427171a5715801f8ea733ffe88d73aaaaf59c5c752ea32cbe7aae8526cc26eabe84ad5043174c0c69b1d6b15a9fb125c15accfac3462d5d08a0faa

  • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

    Filesize

    753B

    MD5

    f21ce9b9b7f338d5e033f7b5d06495ec

    SHA1

    c8d24a983563f9d1e1835d9586a3f1197e769ca4

    SHA256

    f7d9671aaf188b0b196cf37568094c60ece45406df0bc6e0dfefab43241b80f1

    SHA512

    7b4507d2fa9109b4f94748bb502d7b2ff34b3ed6a55d5c2b8679bf8cfb92c70bc36b24fe04c0ce49751d7e6cd4cf3beac2d17dfd0a5b2df2d0bad3d9ce07f17b

  • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

    Filesize

    1.2MB

    MD5

    89ff530102ce123d2395089e83114e98

    SHA1

    cbac5172f22288187fa7423dad65f7c03f5f2a22

    SHA256

    100fbe0bedc27e23dc322f4f4212c665442fae84739adcee5499b81cea7bacab

    SHA512

    f8de17daa14d46f380ee14c54fac190ec5605a223f8debc06d36985ad7729d8f7cc0946f480cfba9c0cd69cf4c948c0cbacacdc212dfb94912452f0d8c257da8

  • C:\Windows\SysWOW64\240627593.txt

    Filesize

    49KB

    MD5

    53bd2f38ed2d24cf2473d0b87cb3b1cb

    SHA1

    459436b4daa0a71c3a33f0d9c9e982dfae4528c2

    SHA256

    de9b5038db701e4c43adc26580c9b5ee64d4552b3b3b78fe616ab0aa3b4a184a

    SHA512

    ed5beb139844dcc43d42daaa69870c33baaa7710e49fe487a206f57679b7d7962ea92dc37fb5ca921eec384216ed1e33431050295a7f92f311bbcfb39cc41941

  • C:\Windows\SysWOW64\ini.ini

    Filesize

    45B

    MD5

    cc125722d3cd0feebb9dcd559b50124f

    SHA1

    5e2d10f51730aff1c23903c7679e94f8fe70886f

    SHA256

    6970a6d1b4e78a8accb2e9531fd5cac9831483946bdea1a88a4a7677c4dae3ef

    SHA512

    5c982f974d7661beccdf8b51e765922dd0c0e1c4dc36859b0063b306057dc8fe1853b34350fc9d3db186b1bd69f8d7662475f4985b9d89a2fae554d4e0748e6e

  • C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

    Filesize

    60KB

    MD5

    889b99c52a60dd49227c5e485a016679

    SHA1

    8fa889e456aa646a4d0a4349977430ce5fa5e2d7

    SHA256

    6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

    SHA512

    08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

  • memory/404-91-0x0000000000400000-0x0000000000760000-memory.dmp

    Filesize

    3.4MB

  • memory/404-94-0x0000000000400000-0x0000000000760000-memory.dmp

    Filesize

    3.4MB

  • memory/404-88-0x0000000000400000-0x0000000000760000-memory.dmp

    Filesize

    3.4MB

  • memory/404-84-0x0000000000400000-0x0000000000760000-memory.dmp

    Filesize

    3.4MB

  • memory/404-0-0x0000000000400000-0x0000000000760000-memory.dmp

    Filesize

    3.4MB

  • memory/404-81-0x0000000000400000-0x0000000000760000-memory.dmp

    Filesize

    3.4MB

  • memory/404-78-0x0000000000400000-0x0000000000760000-memory.dmp

    Filesize

    3.4MB

  • memory/404-97-0x0000000000400000-0x0000000000760000-memory.dmp

    Filesize

    3.4MB

  • memory/404-1-0x0000000000400000-0x0000000000760000-memory.dmp

    Filesize

    3.4MB

  • memory/1196-56-0x0000000010000000-0x00000000101BA000-memory.dmp

    Filesize

    1.7MB

  • memory/1196-61-0x0000000010000000-0x00000000101BA000-memory.dmp

    Filesize

    1.7MB

  • memory/1196-59-0x0000000010000000-0x00000000101BA000-memory.dmp

    Filesize

    1.7MB

  • memory/2092-45-0x0000000010000000-0x00000000101BA000-memory.dmp

    Filesize

    1.7MB

  • memory/2092-46-0x0000000010000000-0x00000000101BA000-memory.dmp

    Filesize

    1.7MB

  • memory/2092-44-0x0000000010000000-0x00000000101BA000-memory.dmp

    Filesize

    1.7MB

  • memory/5072-37-0x0000000010000000-0x00000000101BA000-memory.dmp

    Filesize

    1.7MB

  • memory/5072-38-0x0000000010000000-0x00000000101BA000-memory.dmp

    Filesize

    1.7MB

  • memory/5072-35-0x0000000010000000-0x00000000101BA000-memory.dmp

    Filesize

    1.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.