| File name: | activate.exe |
| Full analysis: | https://app.any.run/tasks/6cbb8572-75b5-4c11-b038-6423139b4ef1 |
| Verdict: | Malicious activity |
| Threats: | CryptBot is an advanced Windows-targeting infostealer delivered via pirate sites with "cracked" software. It has been first observed in the wild in 2019. |
| Analysis date: | September 08, 2024, 03:16:54 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | A90CFE811230B4A0D9FD00F4EC02F4A2 |
| SHA1: | 0BD593F51321032826804674FE2D9D24B0CA45BA |
| SHA256: | 672F8684456A809962EC0BA7FD6F41168954E8DEAC6BBC96315E74112D5081D6 |
| SSDEEP: | 49152:d1P3g/BQTnt23BMP+dvz5zHDg7dq1YZ04bB6pG5a9j+2GTcADkoHxazm7TYt6P8R:7Rm4N0mw |
MALICIOUS
Actions looks like stealing of personal data
- activate.exe (PID: 5124)
CRYPTBOT has been detected (SURICATA)
- activate.exe (PID: 5124)
Connects to the CnC server
- activate.exe (PID: 5124)
CRYPTBOT has been detected (YARA)
- activate.exe (PID: 5124)
Uses Task Scheduler to run other applications
- activate.exe (PID: 5124)
SUSPICIOUS
Searches for installed software
- activate.exe (PID: 5124)
Reads security settings of Internet Explorer
- activate.exe (PID: 5124)
Found regular expressions for crypto-addresses (YARA)
- service123.exe (PID: 7088)
INFO
Reads the computer name
- activate.exe (PID: 5124)
Checks supported languages
- activate.exe (PID: 5124)
- service123.exe (PID: 7088)
- service123.exe (PID: 7160)
Reads CPU info
- activate.exe (PID: 5124)
Create files in a temporary directory
- activate.exe (PID: 5124)
Process checks computer location settings
- activate.exe (PID: 5124)
The process uses the downloaded file
- activate.exe (PID: 5124)
Reads the machine GUID from the registry
- service123.exe (PID: 7088)
- service123.exe (PID: 7160)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
CryptBot
(PID) Process(5124) activate.exe
C2 (1)sevenv7sb.top
Strings (364)CreateDCA
GetTempPathW
InternetOpenA
GetCurrentProcess
sprintf
IsWow64Process2
InternetOpenUrlW
WinHttpConnect
realloc
MoveFileA
CreateDCW
WinHttpReceiveResponse
WinHttpOpenRequest
/zip.php
\peDunUZAKl
GetModuleFileNameExW
GetSystemDirectoryA
GetSystemMetrics
DuplicateHandle
An error occurred while starting the application (0xc000007b). To exit the application, click OK.
ScreenShot.jpeg
VirtualFreeEx
ExpandEnvironmentStringsW
GetDriveTypeW
msvcrt.dll
WideCharToMultiByte
_swprintf
socket
accept
swprintf_s
swprintf
bind
GetCurrentThread
RegQueryValueExW
kernel32.dll
StrStrIA
ExtractFilesW
Process32NextW
MoveFileExW
RegQueryInfoKeyA
_snwprintf
analforeverlovyu.top
shlwapi.dll
\ServiceData\Clip.au3
WinHttpReadData
GetUserNameW
InternetReadFileExW
RmGetList
PathIsDirectoryW
WinHttpReadDataEx
WinHttpAddRequestHeaders
ExitProcess
ShellExecuteA
FCIDestroy
Apps
GetConsoleMode
CreateDirectoryA
wnsprintfA
Sleep
shell32.dll
FindNextFileA
InternetCloseHandle
RegQueryValueExA
RemoveDirectoryW
URLDownloadToFileA
winsqlite3.dll
CreateFileW
GetLastError
BitBlt
ReadConsoleA
InternetOpenUrlA
LocalFree
wininet.dll
VirtualAlloc
HttpQueryInfoA
GetDiskFreeSpaceExW
WinHttpSendRequest
LoadLibraryW
GetFileAttributesA
CloseHandle
GetLogicalDriveStringsW
WaitForSingleObject
POST
LoadLibraryA
SHUnicodeToAnsi
IStream_Read
GetDriveTypeA
CreateFileMappingW
GetCurrentDirectoryA
GetTickCount
GdipGetImageEncoders
crypt32.dll
LoadLibraryExW
GdipSaveImageToFile
GetLocalTime
QueryPerformanceCounter
GetEnvironmentVariableW
CopyFileW
CreateFileMappingA
RegOpenKeyExA
HeapCreate
GetSystemDirectoryW
CopyFileExW
System Error
ole32.dll
CreateMutexA
SetFilePointerEx
ExitThread
GetSystemInfo
GetUserNameA
Temp
"encrypted_key":"
GetModuleHandleExW
InternetConnectW
GdiplusShutdown
GetComputerNameW
UserProfile
DPAPI
FindFirstFileNameA
ReleaseDC
CreateRemoteThread
RegOpenKeyExW
RegEnumKeyExA
vswprintf
CoUninitialize
GetFileInformationByHandle
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
send
SHAnsiToUnicode
GlobalMemoryStatusEx
WinExec
DISPLAY
SleepEx
inet_addr
PathFileExistsA
URLDownloadToFileW
LocalAlloc
Content-Length: %lu
PathFileExistsW
StrStrIW
sprintf_s
EnumDisplaySettingsA
CreateThread
SetFilePointer
FileTimeToSystemTime
GetTempFileNameW
GetSystemWow64DirectoryA
GetKeyboardLayoutList
CreateProcessW
GET
HeapAlloc
ws2_32.dll
GetProcessHeap
UserID.txt
GetDeviceCaps
GetModuleHandleExA
malloc
gdiplus.dll
SHGetFolderPathA
printf
GetLocaleInfoW
listen
AppData
WSACleanup
SelectObject
GdiplusStartup
Others
SetErrorMode
abs
GetProcAddress
NULL
SaveImageToStream
ReadFile
GetFileAttributesW
InternetOpenW
InternetConnectA
WinHttpOpen
gdi32.dll
GetDiskFreeSpaceExA
HttpOpenRequestW
CreateStreamOnHGlobal
RegEnumKeyExW
HttpOpenRequestA
Process32FirstW
CreateCompatibleBitmap
GetModuleHandleA
WriteFile
GetEnvironmentVariableA
InternetReadFile
InternetReadFileExA
FindFirstFileExW
winhttp.dll
GetModuleFileNameW
HeapReAlloc
FCIFlushFolder
RmEndSession
rstrtmgr.dll
$CREEN.JPEG
Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; rv:11.0) like Gecko
WriteConsoleA
GdipSaveImageToStream
Debug.txt
recvfrom
/c schtasks /create /tn \Service\Data /tr """"%wS""" """%wS"""" /st 00:01 /du 9800:59 /sc once /ri 1 /f
RegQueryInfoKeyW
DeleteObject
sevenv7sb.top
Desktop
WinHttpQueryOption
MoveFileW
WinHttpCrackUrl
clock
RmRegisterResources
InternetCrackUrlW
vsnprintf
_wtoi
\ServiceData
GdipGetImageEncodersSize
urlmon.dll
ShellExecuteW
_vscwprintf
IsWow64Process
GdipLoadImageFromFile
ExpandEnvironmentStringsA
CreateDirectoryW
GetModuleFileNameExA
FreeLibrary
OpenThread
MoveFileExA
user32.dll
HeapSize
FCIAddFile
ntdll.dll
log.txt
FindNextFileNameA
Browsers
\ServiceData\Clip.exe
free
IStream_Reset
LocalAppData
GetCurrentDirectoryW
wsprintfW
GetModuleHandleW
curl/8.0.1
closesocket
wsprintfA
SHGetFolderPathW
HttpQueryInfoW
advapi32.dll
WriteConsoleW
GetDIBits
WinHttpQueryHeaders
RtlGetVersion
HTTP
EnumDisplaySettingsW
Extract
WSAGetLastError
GetTickCount64
/gate.php
WSAStartup
FCICreate
ReadConsoleW
_vscprintf
End.txt
HeapFree
RemoveDirectoryA
WinHttpCloseHandle
DeleteDC
Process32NextA
GetExitCodeThread
CreateMutexW
MultiByteToWideChar
VirtualProtectEx
GetVolumeInformationA
GetProcessId
GetTimeZoneInformation
calloc
GetObjectW
VirtualAllocEx
GetFileSize
SystemTimeToFileTime
IsBadReadPtr
FileTimeToDosDateTime
HttpSendRequestW
GetFileSizeEx
URLOpenBlockingStreamA
wprintf
GetFileAttributesExA
CreateCompatibleDC
GetLocaleInfoA
GetTempPathA
GetTempFileNameA
GetUserDefaultLocaleName
IStream_Size
atoi
DeleteFileW
SHCreateMemStream
LoadLibraryExA
GetThreadId
CopyFileA
DeleteFileA
TerminateProcess
CreateRemoteThreadEx
GetObjectA
recv
FCIFlushCabinet
/v1/upload.php
VirtualProtect
CreateProcessA
MessageBoxW
FindFirstFileW
CoInitialize
GetBitmapBits
ReleaseMutex
FindNextFileW
FindFirstFileNameW
_snprintf
GetLogicalDriveStringsA
FindFirstFileExA
CopyFileExA
MessageBoxA
wnsprintfW
cabinet.dll
CreateToolhelp32Snapshot
PathIsDirectoryA
GetCommandLineW
URLOpenBlockingStreamW
Files
WinHttpSetOption
Wallets
advpack.dll
MapViewOfFile
GetNativeSystemInfo
FindFirstFileA
CryptUnprotectData
_snwprintf_s
RmStartSession
LkgwUi
strtod
CreateFileA
RegCloseKey
HTTPS
FindNextFileNameW
GetModuleFileNameA
OpenProcess
User's Computer Information.txt
StretchBlt
GetCommandLineA
HttpSendRequestA
VirtualFree
GetFileAttributesExW
Process32FirstA
UnmapViewOfFile
isspace
GetVolumeInformationW
GdipCreateBitmapFromHBITMAP
/index.php
GetSystemWow64DirectoryW
FindClose
GetComputerNameA
InternetCrackUrlA
ComSpec
htons
ExtractFilesA
TRiD
| .exe | | | Win64 Executable (generic) (64.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (15.3) |
| .exe | | | Win32 Executable (generic) (10.5) |
| .exe | | | Generic Win/DOS Executable (4.6) |
| .exe | | | DOS Executable Generic (4.6) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:09:07 18:54:29+00:00 |
| ImageFileCharacteristics: | Executable, No line numbers, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 2.35 |
| CodeSize: | 4723712 |
| InitializedDataSize: | 5948416 |
| UninitializedDataSize: | 6743040 |
| EntryPoint: | 0x14b0 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Total processes
128
Monitored processes
6
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2256 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3176 | "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f | C:\Windows\SysWOW64\schtasks.exe | — | activate.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Task Scheduler Configuration Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4820 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | schtasks.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5124 | "C:\Users\admin\AppData\Local\Temp\activate.exe" | C:\Users\admin\AppData\Local\Temp\activate.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
CryptBot(PID) Process(5124) activate.exe C2 (1)sevenv7sb.top Strings (364)CreateDCA GetTempPathW InternetOpenA GetCurrentProcess sprintf IsWow64Process2 InternetOpenUrlW WinHttpConnect realloc MoveFileA CreateDCW WinHttpReceiveResponse WinHttpOpenRequest /zip.php \peDunUZAKl GetModuleFileNameExW GetSystemDirectoryA GetSystemMetrics DuplicateHandle An error occurred while starting the application (0xc000007b). To exit the application, click OK. ScreenShot.jpeg VirtualFreeEx ExpandEnvironmentStringsW GetDriveTypeW msvcrt.dll WideCharToMultiByte _swprintf socket accept swprintf_s swprintf bind GetCurrentThread RegQueryValueExW kernel32.dll StrStrIA ExtractFilesW Process32NextW MoveFileExW RegQueryInfoKeyA _snwprintf analforeverlovyu.top shlwapi.dll \ServiceData\Clip.au3 WinHttpReadData GetUserNameW InternetReadFileExW RmGetList PathIsDirectoryW WinHttpReadDataEx WinHttpAddRequestHeaders ExitProcess ShellExecuteA FCIDestroy Apps GetConsoleMode CreateDirectoryA wnsprintfA Sleep shell32.dll FindNextFileA InternetCloseHandle RegQueryValueExA RemoveDirectoryW URLDownloadToFileA winsqlite3.dll CreateFileW GetLastError BitBlt ReadConsoleA InternetOpenUrlA LocalFree wininet.dll VirtualAlloc HttpQueryInfoA GetDiskFreeSpaceExW WinHttpSendRequest LoadLibraryW GetFileAttributesA CloseHandle GetLogicalDriveStringsW WaitForSingleObject POST LoadLibraryA SHUnicodeToAnsi IStream_Read GetDriveTypeA CreateFileMappingW GetCurrentDirectoryA GetTickCount GdipGetImageEncoders crypt32.dll LoadLibraryExW GdipSaveImageToFile GetLocalTime QueryPerformanceCounter GetEnvironmentVariableW CopyFileW CreateFileMappingA RegOpenKeyExA HeapCreate GetSystemDirectoryW CopyFileExW System Error ole32.dll CreateMutexA SetFilePointerEx ExitThread GetSystemInfo GetUserNameA Temp "encrypted_key":" GetModuleHandleExW InternetConnectW GdiplusShutdown GetComputerNameW UserProfile DPAPI FindFirstFileNameA ReleaseDC CreateRemoteThread RegOpenKeyExW RegEnumKeyExA vswprintf CoUninitialize GetFileInformationByHandle Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 send SHAnsiToUnicode GlobalMemoryStatusEx WinExec DISPLAY SleepEx inet_addr PathFileExistsA URLDownloadToFileW LocalAlloc Content-Length: %lu PathFileExistsW StrStrIW sprintf_s EnumDisplaySettingsA CreateThread SetFilePointer FileTimeToSystemTime GetTempFileNameW GetSystemWow64DirectoryA GetKeyboardLayoutList CreateProcessW GET HeapAlloc ws2_32.dll GetProcessHeap UserID.txt GetDeviceCaps GetModuleHandleExA malloc gdiplus.dll SHGetFolderPathA printf GetLocaleInfoW listen AppData WSACleanup SelectObject GdiplusStartup Others SetErrorMode abs GetProcAddress NULL SaveImageToStream ReadFile GetFileAttributesW InternetOpenW InternetConnectA WinHttpOpen gdi32.dll GetDiskFreeSpaceExA HttpOpenRequestW CreateStreamOnHGlobal RegEnumKeyExW HttpOpenRequestA Process32FirstW CreateCompatibleBitmap GetModuleHandleA WriteFile GetEnvironmentVariableA InternetReadFile InternetReadFileExA FindFirstFileExW winhttp.dll GetModuleFileNameW HeapReAlloc FCIFlushFolder RmEndSession rstrtmgr.dll $CREEN.JPEG Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; rv:11.0) like Gecko WriteConsoleA GdipSaveImageToStream Debug.txt recvfrom /c schtasks /create /tn \Service\Data /tr """"%wS""" """%wS"""" /st 00:01 /du 9800:59 /sc once /ri 1 /f RegQueryInfoKeyW DeleteObject sevenv7sb.top Desktop WinHttpQueryOption MoveFileW WinHttpCrackUrl clock RmRegisterResources InternetCrackUrlW vsnprintf _wtoi \ServiceData GdipGetImageEncodersSize urlmon.dll ShellExecuteW _vscwprintf IsWow64Process GdipLoadImageFromFile ExpandEnvironmentStringsA CreateDirectoryW GetModuleFileNameExA FreeLibrary OpenThread MoveFileExA user32.dll HeapSize FCIAddFile ntdll.dll log.txt FindNextFileNameA Browsers \ServiceData\Clip.exe free IStream_Reset LocalAppData GetCurrentDirectoryW wsprintfW GetModuleHandleW curl/8.0.1 closesocket wsprintfA SHGetFolderPathW HttpQueryInfoW advapi32.dll WriteConsoleW GetDIBits WinHttpQueryHeaders RtlGetVersion HTTP EnumDisplaySettingsW Extract WSAGetLastError GetTickCount64 /gate.php WSAStartup FCICreate ReadConsoleW _vscprintf End.txt HeapFree RemoveDirectoryA WinHttpCloseHandle DeleteDC Process32NextA GetExitCodeThread CreateMutexW MultiByteToWideChar VirtualProtectEx GetVolumeInformationA GetProcessId GetTimeZoneInformation calloc GetObjectW VirtualAllocEx GetFileSize SystemTimeToFileTime IsBadReadPtr FileTimeToDosDateTime HttpSendRequestW GetFileSizeEx URLOpenBlockingStreamA wprintf GetFileAttributesExA CreateCompatibleDC GetLocaleInfoA GetTempPathA GetTempFileNameA GetUserDefaultLocaleName IStream_Size atoi DeleteFileW SHCreateMemStream LoadLibraryExA GetThreadId CopyFileA DeleteFileA TerminateProcess CreateRemoteThreadEx GetObjectA recv FCIFlushCabinet /v1/upload.php VirtualProtect CreateProcessA MessageBoxW FindFirstFileW CoInitialize GetBitmapBits ReleaseMutex FindNextFileW FindFirstFileNameW _snprintf GetLogicalDriveStringsA FindFirstFileExA CopyFileExA MessageBoxA wnsprintfW cabinet.dll CreateToolhelp32Snapshot PathIsDirectoryA GetCommandLineW URLOpenBlockingStreamW Files WinHttpSetOption Wallets advpack.dll MapViewOfFile GetNativeSystemInfo FindFirstFileA CryptUnprotectData _snwprintf_s RmStartSession LkgwUi strtod CreateFileA RegCloseKey HTTPS FindNextFileNameW GetModuleFileNameA OpenProcess User's Computer Information.txt StretchBlt GetCommandLineA HttpSendRequestA VirtualFree GetFileAttributesExW Process32FirstA UnmapViewOfFile isspace GetVolumeInformationW GdipCreateBitmapFromHBITMAP /index.php GetSystemWow64DirectoryW FindClose GetComputerNameA InternetCrackUrlA ComSpec htons ExtractFilesA | |||||||||||||||
| 7088 | "C:\Users\admin\AppData\Local\Temp\service123.exe" | C:\Users\admin\AppData\Local\Temp\service123.exe | activate.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 7160 | "C:\Users\admin\AppData\Local\Temp\/service123.exe" | C:\Users\admin\AppData\Local\Temp\service123.exe | — | svchost.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
Total events
1 110
Read events
1 110
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5124 | activate.exe | C:\Users\admin\AppData\Local\Temp\service123.exe | — | |
MD5:— | SHA256:— | |||
| 5124 | activate.exe | C:\Users\admin\AppData\Local\Temp\nChtbJyUpNXUKluFgzAm.dll | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
25
DNS requests
14
Threats
5
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2120 | MoUsoCoreWorker.exe | GET | 200 | 23.52.120.96:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5124 | activate.exe | POST | 200 | 80.249.144.180:80 | http://sevenv7sb.top/v1/upload.php | unknown | — | — | unknown |
3652 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5124 | activate.exe | POST | 200 | 80.249.144.180:80 | http://sevenv7sb.top/v1/upload.php | unknown | — | — | unknown |
5124 | activate.exe | POST | 200 | 80.249.144.180:80 | http://sevenv7sb.top/v1/upload.php | unknown | — | — | unknown |
7072 | SIHClient.exe | GET | 200 | 23.52.120.96:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
7072 | SIHClient.exe | GET | 200 | 23.52.120.96:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4316 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2120 | MoUsoCoreWorker.exe | 23.52.120.96:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
6052 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3260 | svchost.exe | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3652 | svchost.exe | 40.126.32.68:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3652 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
sevenv7sb.top |
| unknown |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2256 | svchost.exe | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
5124 | activate.exe | Potentially Bad Traffic | ET INFO HTTP Request to a *.top domain |
5124 | activate.exe | A Network Trojan was detected | ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 |
5124 | activate.exe | A Network Trojan was detected | ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 |
5124 | activate.exe | A Network Trojan was detected | ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 |