Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2024, 19:44 UTC

General

  • Target

    faf9ec3afdae4d4e1669ece128ec6ebe85ca010cc551f6d42ff08da9446178b3.exe

  • Size

    1.2MB

  • MD5

    ec01c3b68f68a12c83915732cffbae43

  • SHA1

    bc52452baa78597fbed2ea5271aa3d089b9b7845

  • SHA256

    faf9ec3afdae4d4e1669ece128ec6ebe85ca010cc551f6d42ff08da9446178b3

  • SHA512

    fd4e28244e91bdd5f979a833753ba06beb6c84b821528754c5857e5efc16f111407657ab5291a8b0d494337c7de771cd099d0925680a8823c9a0bfc8e2332682

  • SSDEEP

    24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtiV:WIwgMEuy+inDfp3/XoCw57XYBwKV

Malware Config

Signatures

  • Detect PurpleFox Rootkit 7 IoCs

    Detect PurpleFox Rootkit.

  • Gh0st RAT payload 8 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Gh0strat family
  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

  • Purplefox family
  • Drops file in Drivers directory 1 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 3 IoCs
  • VMProtect packed file 10 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 7 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\faf9ec3afdae4d4e1669ece128ec6ebe85ca010cc551f6d42ff08da9446178b3.exe
    "C:\Users\Admin\AppData\Local\Temp\faf9ec3afdae4d4e1669ece128ec6ebe85ca010cc551f6d42ff08da9446178b3.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4416
    • C:\Users\Admin\AppData\Local\Temp\AK47.exe
      "C:\Users\Admin\AppData\Local\Temp\AK47.exe"
      2⤵
      • Server Software Component: Terminal Services DLL
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:4836
    • C:\Users\Admin\AppData\Local\Temp\AK47.exe
      C:\Users\Admin\AppData\Local\Temp\\AK47.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:4724
    • C:\Users\Admin\AppData\Local\Temp\AK74.exe
      C:\Users\Admin\AppData\Local\Temp\\AK74.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3268
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\AK74.exe > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:3752
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:3864
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5076
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3256
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
    1⤵
      PID:4040
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3204
      • C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
        C:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240627218.txt",MainThread
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:1320
    • C:\Windows\SysWOW64\Ghiya.exe
      C:\Windows\SysWOW64\Ghiya.exe -auto
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4268
      • C:\Windows\SysWOW64\Ghiya.exe
        C:\Windows\SysWOW64\Ghiya.exe -acsi
        2⤵
        • Drops file in Drivers directory
        • Sets service image path in registry
        • Executes dropped EXE
        • Suspicious behavior: LoadsDriver
        • Suspicious use of AdjustPrivilegeToken
        PID:3028

    Network

    • flag-us
      DNS
      209.205.72.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      209.205.72.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      88.210.23.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      88.210.23.2.in-addr.arpa
      IN PTR
      Response
      88.210.23.2.in-addr.arpa
      IN PTR
      a2-23-210-88deploystaticakamaitechnologiescom
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      64.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      64.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      217.106.137.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      217.106.137.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      56.163.245.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      56.163.245.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      15.164.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      15.164.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      14.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      14.227.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • flag-us
      DNS
      cf1549064127.f3322.net
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      Remote address:
      8.8.8.8:53
      Request
      cf1549064127.f3322.net
      IN A
      Response
    • 43.249.193.73:54997
      faf9ec3afdae4d4e1669ece128ec6ebe85ca010cc551f6d42ff08da9446178b3.exe
      260 B
      5
    • 43.249.193.73:54997
      faf9ec3afdae4d4e1669ece128ec6ebe85ca010cc551f6d42ff08da9446178b3.exe
      260 B
      5
    • 43.249.193.73:54997
      faf9ec3afdae4d4e1669ece128ec6ebe85ca010cc551f6d42ff08da9446178b3.exe
      260 B
      5
    • 43.249.193.73:54997
      faf9ec3afdae4d4e1669ece128ec6ebe85ca010cc551f6d42ff08da9446178b3.exe
      260 B
      5
    • 43.249.193.73:54997
      faf9ec3afdae4d4e1669ece128ec6ebe85ca010cc551f6d42ff08da9446178b3.exe
      260 B
      5
    • 43.249.193.73:54997
      faf9ec3afdae4d4e1669ece128ec6ebe85ca010cc551f6d42ff08da9446178b3.exe
      260 B
      5
    • 43.249.193.73:54997
      faf9ec3afdae4d4e1669ece128ec6ebe85ca010cc551f6d42ff08da9446178b3.exe
      260 B
      5
    • 8.8.8.8:53
      209.205.72.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      209.205.72.20.in-addr.arpa

    • 8.8.8.8:53
      88.210.23.2.in-addr.arpa
      dns
      70 B
      133 B
      1
      1

      DNS Request

      88.210.23.2.in-addr.arpa

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      64.159.190.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      64.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      217.106.137.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      217.106.137.52.in-addr.arpa

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      56.163.245.4.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      56.163.245.4.in-addr.arpa

    • 8.8.8.8:53
      15.164.165.52.in-addr.arpa
      dns
      72 B
      146 B
      1
      1

      DNS Request

      15.164.165.52.in-addr.arpa

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      14.227.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      14.227.111.52.in-addr.arpa

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      136 B
      258 B
      2
      2

      DNS Request

      cf1549064127.f3322.net

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    • 8.8.8.8:53
      cf1549064127.f3322.net
      dns
      Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
      68 B
      129 B
      1
      1

      DNS Request

      cf1549064127.f3322.net

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\AK47.exe

      Filesize

      91KB

      MD5

      423eb994ed553294f8a6813619b8da87

      SHA1

      eca6a16ccd13adcfc27bc1041ddef97ec8081255

      SHA256

      050b4f2d5ae8eaecd414318dc8e222a56f169626da6ca8feb7edd78e8b1f0218

      SHA512

      fab0a9af8031c242c486de373df7277c8b0e39f7a0c9c2ac2e385dbd3ea67be16e91b128287634f76131e5264149ab1b452cd21df4c4895e8c4efc8d8cf99095

    • C:\Users\Admin\AppData\Local\Temp\AK74.exe

      Filesize

      400KB

      MD5

      b0998aa7d5071d33daa5b60b9c3c9735

      SHA1

      9365a1ff0c6de244d6f36c8d84072cc916665d3c

      SHA256

      3080b6bb456564899b0d99d4131bd6a0b284d31f7d80ef773e4872d94048d49a

      SHA512

      308c13cda9fea39b980ae686f44afd9090e9cb8970fffc4436320e0d09a31aee5e656914e0121fe888098a14c52749716fa04980396fd6ac70a88c11cbb6b850

    • C:\Users\Admin\AppData\Roaming\Microsoft\Config.ini

      Filesize

      92B

      MD5

      29ce53e2a4a446614ccc8d64d346bde4

      SHA1

      39a7aa5cc1124842aa0c25abb16ea94452125cbe

      SHA256

      56225be6838bc6e93ea215891eacf28844ae27a9f8b2b29bf19d3a8c2b1f58df

      SHA512

      b2c5a2708c427171a5715801f8ea733ffe88d73aaaaf59c5c752ea32cbe7aae8526cc26eabe84ad5043174c0c69b1d6b15a9fb125c15accfac3462d5d08a0faa

    • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs

      Filesize

      753B

      MD5

      11df5ca9b5a6d95d59dd32e59e415a58

      SHA1

      c7335d27e8d84357cbdb78df8ce41de954c33826

      SHA256

      cb92f921e87646ae38778e8275ebe38d4ae1d8c7cadbb0de9af9d43a45f5d688

      SHA512

      eee8c7858d17a45eb951eaa614c05374c6d17e4c3b750683a5198bc6f5c4abd2ef3987ddd8808e3964c96b3001b806df7a5837210a5b1eb0cd718e9047b9d807

    • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe

      Filesize

      1.2MB

      MD5

      8fd5d924b12fb7cd1f1b4f101816af2b

      SHA1

      541adafc8e3b0467d598a1fa2cc3500761dd1840

      SHA256

      6a31246992603e290f9239f94ae31f0dbf6b4ba838b217a5017d7e5ccac55064

      SHA512

      cd20ec127c479d0dc19f3d960d483ba460b0a5cbbcc91043de36f5707bc3561553e627bb82bdabcceed9ec210dbaf459aaedbd04773cf39783ea0ea9d7ff3561

    • C:\Windows\SysWOW64\240627218.txt

      Filesize

      49KB

      MD5

      e8a5bc854aae182c46565e713db03914

      SHA1

      238ea2610df8fb4c0abc8a638c1593c07251f270

      SHA256

      241066d85e1024521979e0b59bd2014663b1191d9afadb50280b6e1cd46eb04f

      SHA512

      4d1ca733787f6f19f2e50b899369987a3f98047c65ed28aebde6aabf9d18e024befb0640769dc60da3b30d9b47607a1d2fe6c8a4ffc3bd2a2cdce40c5738b3fc

    • C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe

      Filesize

      60KB

      MD5

      889b99c52a60dd49227c5e485a016679

      SHA1

      8fa889e456aa646a4d0a4349977430ce5fa5e2d7

      SHA256

      6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

      SHA512

      08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

    • memory/3028-50-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/3028-55-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/3028-54-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/3268-31-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/3268-30-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/3268-28-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/4268-40-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/4268-39-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/4268-37-0x0000000010000000-0x00000000101BA000-memory.dmp

      Filesize

      1.7MB

    • memory/4416-72-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/4416-0-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/4416-75-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/4416-78-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/4416-82-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/4416-2-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/4416-85-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/4416-88-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    • memory/4416-91-0x0000000000400000-0x0000000000760000-memory.dmp

      Filesize

      3.4MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.