| File name: | Set-up.exe |
| Full analysis: | https://app.any.run/tasks/52920887-1247-4ac1-8d7e-decd7ff217f5 |
| Verdict: | Malicious activity |
| Threats: | CryptBot is an advanced Windows-targeting infostealer delivered via pirate sites with "cracked" software. It has been first observed in the wild in 2019. |
| Analysis date: | September 02, 2024, 14:13:42 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 85D96EE922573CC80094A067166449DC |
| SHA1: | 842C2CCF1B496EC0C4A7904DE3244024AAE32C83 |
| SHA256: | 7E21037408A27FDEDDB6C6A584E66F96CCE79187565001A4E7854A469039E6E5 |
| SSDEEP: | 49152:Tmb5VJgMo2wfoqwJiOl9WvzyDyHwI/uRlKPHh57fyy8nsEHQwUUjtdAIbs0KboSC:TiYrHfk2LMBN |
MALICIOUS
LUMMA has been detected (YARA)
- Set-up.exe (PID: 3812)
Actions looks like stealing of personal data
- Set-up.exe (PID: 3812)
CRYPTBOT has been detected (YARA)
- Set-up.exe (PID: 3812)
CRYPTBOT has been detected (SURICATA)
- Set-up.exe (PID: 3812)
Connects to the CnC server
- Set-up.exe (PID: 3812)
Uses Task Scheduler to run other applications
- Set-up.exe (PID: 3812)
SUSPICIOUS
Searches for installed software
- Set-up.exe (PID: 3812)
Reads security settings of Internet Explorer
- Set-up.exe (PID: 3812)
Reads the date of Windows installation
- Set-up.exe (PID: 3812)
Found regular expressions for crypto-addresses (YARA)
- service123.exe (PID: 6984)
The process executes via Task Scheduler
- service123.exe (PID: 5720)
INFO
Checks supported languages
- Set-up.exe (PID: 3812)
- service123.exe (PID: 6984)
- service123.exe (PID: 5720)
Reads CPU info
- Set-up.exe (PID: 3812)
Reads the computer name
- Set-up.exe (PID: 3812)
Create files in a temporary directory
- Set-up.exe (PID: 3812)
Process checks computer location settings
- Set-up.exe (PID: 3812)
The process uses the downloaded file
- Set-up.exe (PID: 3812)
Reads the machine GUID from the registry
- service123.exe (PID: 5720)
- service123.exe (PID: 6984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
CryptBot
(PID) Process(3812) Set-up.exe
C2 (1)twoxv2pn.top
Strings (364)GetUserNameA
Process32NextA
atoi
InternetOpenW
send
_wtoi
GetTimeZoneInformation
GetObjectA
urlmon.dll
CreateFileMappingW
HeapAlloc
SHAnsiToUnicode
GetTempFileNameA
advapi32.dll
listen
SHGetFolderPathA
wprintf
MessageBoxA
GetSystemDirectoryW
HttpOpenRequestA
GetModuleHandleW
GetDriveTypeW
RegQueryValueExA
GdipGetImageEncoders
WinHttpReceiveResponse
CoInitialize
GetFileAttributesExA
AppData
GetFileSize
VirtualFree
crypt32.dll
URLDownloadToFileA
msvcrt.dll
GetModuleFileNameA
WinHttpSendRequest
_snwprintf
FCICreate
malloc
RemoveDirectoryA
Wallets
CreateFileA
GetComputerNameW
swprintf_s
GetConsoleMode
GetBitmapBits
ExtractFilesW
/v1/upload.php
POST
user32.dll
FileTimeToSystemTime
CoUninitialize
GetDIBits
ReadFile
InternetCrackUrlA
MultiByteToWideChar
GetSystemMetrics
FindFirstFileExW
ScreenShot.jpeg
URLOpenBlockingStreamW
InternetConnectW
GetFileSizeEx
_snwprintf_s
DeleteFileW
Content-Length: %lu
swprintf
wnsprintfA
LoadLibraryW
GetEnvironmentVariableA
_vscprintf
closesocket
LoadLibraryExW
GetProcessId
ExitThread
IStream_Reset
GetModuleFileNameW
GetTickCount64
HeapReAlloc
InternetReadFile
DPAPI
RtlGetVersion
GetTempPathA
Sleep
/zip.php
PathFileExistsW
SetErrorMode
twoxv2pn.top
GetLocalTime
CreateProcessA
ExtractFilesA
GetDeviceCaps
StrStrIA
HTTPS
realloc
RegQueryValueExW
IStream_Size
printf
End.txt
CreateFileMappingA
WideCharToMultiByte
Browsers
GetCurrentDirectoryW
GetTickCount
RmGetList
CreateRemoteThread
WriteConsoleW
InternetCloseHandle
UserProfile
WinHttpSetOption
\ServiceData\Clip.au3
Temp
FindNextFileNameW
GetSystemDirectoryA
log.txt
InternetReadFileExW
PathIsDirectoryA
IStream_Read
wnsprintfW
advpack.dll
UnmapViewOfFile
wininet.dll
CreateDirectoryW
ExpandEnvironmentStringsW
RemoveDirectoryW
"encrypted_key":"
RmEndSession
GdipCreateBitmapFromHBITMAP
Files
FCIFlushCabinet
SHCreateMemStream
FindFirstFileNameA
BitBlt
GetFileAttributesW
GetSystemInfo
curl/8.0.1
WinHttpReadData
ReleaseDC
Process32NextW
ShellExecuteA
HeapCreate
RmStartSession
_swprintf
htons
shell32.dll
RegOpenKeyExA
InternetOpenUrlA
Process32FirstW
CopyFileExA
GdipSaveImageToStream
ntdll.dll
\ServiceData\Clip.exe
An error occurred while starting the application (0xc000007b). To exit the application, click OK.
CreateMutexA
FindFirstFileExA
LoadLibraryExA
VirtualProtectEx
FindNextFileA
GetEnvironmentVariableW
GetComputerNameA
GetNativeSystemInfo
FindClose
GetCurrentDirectoryA
strtod
CreateRemoteThreadEx
FindFirstFileW
HeapSize
inet_addr
CreateDirectoryA
IsWow64Process2
WinHttpConnect
Desktop
MoveFileExA
GetLastError
FCIAddFile
InternetOpenA
/c schtasks /create /tn \Service\Data /tr """"%wS""" """%wS"""" /st 00:01 /du 9800:59 /sc once /ri 1 /f
GetTempFileNameW
CopyFileA
socket
FCIFlushFolder
GdipSaveImageToFile
SystemTimeToFileTime
GetThreadId
MoveFileA
ComSpec
GetLocaleInfoW
WinHttpOpenRequest
CreateToolhelp32Snapshot
SelectObject
ReadConsoleW
ws2_32.dll
_snprintf
FindFirstFileNameW
CreateStreamOnHGlobal
WinHttpQueryHeaders
LocalAlloc
HttpSendRequestW
FindNextFileW
DuplicateHandle
LkgwUi
GetModuleFileNameExA
EnumDisplaySettingsA
WinHttpQueryOption
CreateFileW
FindFirstFileA
ShellExecuteW
CopyFileExW
SetFilePointer
GetCommandLineW
HttpOpenRequestW
free
SleepEx
GetVolumeInformationA
winhttp.dll
GetLogicalDriveStringsA
SetFilePointerEx
GetKeyboardLayoutList
SHGetFolderPathW
SaveImageToStream
RmRegisterResources
GetTempPathW
LoadLibraryA
URLDownloadToFileW
vsnprintf
OpenProcess
GetLogicalDriveStringsW
HttpQueryInfoW
GetDiskFreeSpaceExW
RegOpenKeyExW
vswprintf
WinHttpAddRequestHeaders
GetSystemWow64DirectoryA
WinExec
ole32.dll
FindNextFileNameA
System Error
UserID.txt
DISPLAY
analforeverlovyu.top
MessageBoxW
CreateDCW
GetDriveTypeA
DeleteDC
rstrtmgr.dll
RegQueryInfoKeyW
OpenThread
RegEnumKeyExW
Others
InternetOpenUrlW
DeleteFileA
CreateDCA
GET
CreateMutexW
DeleteObject
CloseHandle
LocalAppData
InternetCrackUrlW
User's Computer Information.txt
RegCloseKey
GetProcessHeap
MapViewOfFile
CryptUnprotectData
VirtualAlloc
CreateCompatibleBitmap
WinHttpCrackUrl
CreateProcessW
GetModuleFileNameExW
LocalFree
GetFileInformationByHandle
WinHttpReadDataEx
Apps
StrStrIW
abs
GetUserDefaultLocaleName
sprintf
\ServiceData
Debug.txt
wsprintfW
ExpandEnvironmentStringsA
GetCurrentProcess
GetFileAttributesExW
GetProcAddress
cabinet.dll
WaitForSingleObject
WriteConsoleA
sprintf_s
\IPKqAOPIgs
bind
GdiplusShutdown
EnumDisplaySettingsW
MoveFileW
WinHttpOpen
Extract
shlwapi.dll
Process32FirstA
TerminateProcess
GetFileAttributesA
CreateCompatibleDC
GetSystemWow64DirectoryW
GetCommandLineA
NULL
URLOpenBlockingStreamA
CopyFileW
InternetReadFileExA
/gate.php
accept
MoveFileExW
/index.php
GdipGetImageEncodersSize
WinHttpCloseHandle
GetModuleHandleA
WSAStartup
isspace
recv
PathIsDirectoryW
calloc
WriteFile
GetLocaleInfoA
kernel32.dll
_vscwprintf
GetModuleHandleExA
HttpSendRequestA
HttpQueryInfoA
GetObjectW
FreeLibrary
FileTimeToDosDateTime
WSAGetLastError
WSACleanup
VirtualProtect
gdi32.dll
RegEnumKeyExA
VirtualFreeEx
QueryPerformanceCounter
recvfrom
GetCurrentThread
Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; rv:11.0) like Gecko
winsqlite3.dll
GetModuleHandleExW
GetUserNameW
InternetConnectA
IsBadReadPtr
ReadConsoleA
RegQueryInfoKeyA
IsWow64Process
GlobalMemoryStatusEx
clock
HeapFree
GetVolumeInformationW
GetDiskFreeSpaceExA
SHUnicodeToAnsi
CreateThread
wsprintfA
gdiplus.dll
$CREEN.JPEG
StretchBlt
FCIDestroy
ReleaseMutex
GdipLoadImageFromFile
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
HTTP
GdiplusStartup
PathFileExistsA
VirtualAllocEx
ExitProcess
GetExitCodeThread
TRiD
| .exe | | | Win64 Executable (generic) (64.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (15.3) |
| .exe | | | Win32 Executable (generic) (10.5) |
| .exe | | | Generic Win/DOS Executable (4.6) |
| .exe | | | DOS Executable Generic (4.6) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:09:02 09:36:12+00:00 |
| ImageFileCharacteristics: | Executable, No line numbers, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 2.35 |
| CodeSize: | 4692992 |
| InitializedDataSize: | 5906432 |
| UninitializedDataSize: | 6743040 |
| EntryPoint: | 0x14b0 |
| OSVersion: | 4 |
| ImageVersion: | 1 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Total processes
124
Monitored processes
6
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1124 | "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f | C:\Windows\SysWOW64\schtasks.exe | — | Set-up.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Task Scheduler Configuration Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1292 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | schtasks.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2256 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3812 | "C:\Users\admin\AppData\Local\Temp\Set-up.exe" | C:\Users\admin\AppData\Local\Temp\Set-up.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
CryptBot(PID) Process(3812) Set-up.exe C2 (1)twoxv2pn.top Strings (364)GetUserNameA Process32NextA atoi InternetOpenW send _wtoi GetTimeZoneInformation GetObjectA urlmon.dll CreateFileMappingW HeapAlloc SHAnsiToUnicode GetTempFileNameA advapi32.dll listen SHGetFolderPathA wprintf MessageBoxA GetSystemDirectoryW HttpOpenRequestA GetModuleHandleW GetDriveTypeW RegQueryValueExA GdipGetImageEncoders WinHttpReceiveResponse CoInitialize GetFileAttributesExA AppData GetFileSize VirtualFree crypt32.dll URLDownloadToFileA msvcrt.dll GetModuleFileNameA WinHttpSendRequest _snwprintf FCICreate malloc RemoveDirectoryA Wallets CreateFileA GetComputerNameW swprintf_s GetConsoleMode GetBitmapBits ExtractFilesW /v1/upload.php POST user32.dll FileTimeToSystemTime CoUninitialize GetDIBits ReadFile InternetCrackUrlA MultiByteToWideChar GetSystemMetrics FindFirstFileExW ScreenShot.jpeg URLOpenBlockingStreamW InternetConnectW GetFileSizeEx _snwprintf_s DeleteFileW Content-Length: %lu swprintf wnsprintfA LoadLibraryW GetEnvironmentVariableA _vscprintf closesocket LoadLibraryExW GetProcessId ExitThread IStream_Reset GetModuleFileNameW GetTickCount64 HeapReAlloc InternetReadFile DPAPI RtlGetVersion GetTempPathA Sleep /zip.php PathFileExistsW SetErrorMode twoxv2pn.top GetLocalTime CreateProcessA ExtractFilesA GetDeviceCaps StrStrIA HTTPS realloc RegQueryValueExW IStream_Size printf End.txt CreateFileMappingA WideCharToMultiByte Browsers GetCurrentDirectoryW GetTickCount RmGetList CreateRemoteThread WriteConsoleW InternetCloseHandle UserProfile WinHttpSetOption \ServiceData\Clip.au3 Temp FindNextFileNameW GetSystemDirectoryA log.txt InternetReadFileExW PathIsDirectoryA IStream_Read wnsprintfW advpack.dll UnmapViewOfFile wininet.dll CreateDirectoryW ExpandEnvironmentStringsW RemoveDirectoryW "encrypted_key":" RmEndSession GdipCreateBitmapFromHBITMAP Files FCIFlushCabinet SHCreateMemStream FindFirstFileNameA BitBlt GetFileAttributesW GetSystemInfo curl/8.0.1 WinHttpReadData ReleaseDC Process32NextW ShellExecuteA HeapCreate RmStartSession _swprintf htons shell32.dll RegOpenKeyExA InternetOpenUrlA Process32FirstW CopyFileExA GdipSaveImageToStream ntdll.dll \ServiceData\Clip.exe An error occurred while starting the application (0xc000007b). To exit the application, click OK. CreateMutexA FindFirstFileExA LoadLibraryExA VirtualProtectEx FindNextFileA GetEnvironmentVariableW GetComputerNameA GetNativeSystemInfo FindClose GetCurrentDirectoryA strtod CreateRemoteThreadEx FindFirstFileW HeapSize inet_addr CreateDirectoryA IsWow64Process2 WinHttpConnect Desktop MoveFileExA GetLastError FCIAddFile InternetOpenA /c schtasks /create /tn \Service\Data /tr """"%wS""" """%wS"""" /st 00:01 /du 9800:59 /sc once /ri 1 /f GetTempFileNameW CopyFileA socket FCIFlushFolder GdipSaveImageToFile SystemTimeToFileTime GetThreadId MoveFileA ComSpec GetLocaleInfoW WinHttpOpenRequest CreateToolhelp32Snapshot SelectObject ReadConsoleW ws2_32.dll _snprintf FindFirstFileNameW CreateStreamOnHGlobal WinHttpQueryHeaders LocalAlloc HttpSendRequestW FindNextFileW DuplicateHandle LkgwUi GetModuleFileNameExA EnumDisplaySettingsA WinHttpQueryOption CreateFileW FindFirstFileA ShellExecuteW CopyFileExW SetFilePointer GetCommandLineW HttpOpenRequestW free SleepEx GetVolumeInformationA winhttp.dll GetLogicalDriveStringsA SetFilePointerEx GetKeyboardLayoutList SHGetFolderPathW SaveImageToStream RmRegisterResources GetTempPathW LoadLibraryA URLDownloadToFileW vsnprintf OpenProcess GetLogicalDriveStringsW HttpQueryInfoW GetDiskFreeSpaceExW RegOpenKeyExW vswprintf WinHttpAddRequestHeaders GetSystemWow64DirectoryA WinExec ole32.dll FindNextFileNameA System Error UserID.txt DISPLAY analforeverlovyu.top MessageBoxW CreateDCW GetDriveTypeA DeleteDC rstrtmgr.dll RegQueryInfoKeyW OpenThread RegEnumKeyExW Others InternetOpenUrlW DeleteFileA CreateDCA GET CreateMutexW DeleteObject CloseHandle LocalAppData InternetCrackUrlW User's Computer Information.txt RegCloseKey GetProcessHeap MapViewOfFile CryptUnprotectData VirtualAlloc CreateCompatibleBitmap WinHttpCrackUrl CreateProcessW GetModuleFileNameExW LocalFree GetFileInformationByHandle WinHttpReadDataEx Apps StrStrIW abs GetUserDefaultLocaleName sprintf \ServiceData Debug.txt wsprintfW ExpandEnvironmentStringsA GetCurrentProcess GetFileAttributesExW GetProcAddress cabinet.dll WaitForSingleObject WriteConsoleA sprintf_s \IPKqAOPIgs bind GdiplusShutdown EnumDisplaySettingsW MoveFileW WinHttpOpen Extract shlwapi.dll Process32FirstA TerminateProcess GetFileAttributesA CreateCompatibleDC GetSystemWow64DirectoryW GetCommandLineA NULL URLOpenBlockingStreamA CopyFileW InternetReadFileExA /gate.php accept MoveFileExW /index.php GdipGetImageEncodersSize WinHttpCloseHandle GetModuleHandleA WSAStartup isspace recv PathIsDirectoryW calloc WriteFile GetLocaleInfoA kernel32.dll _vscwprintf GetModuleHandleExA HttpSendRequestA HttpQueryInfoA GetObjectW FreeLibrary FileTimeToDosDateTime WSAGetLastError WSACleanup VirtualProtect gdi32.dll RegEnumKeyExA VirtualFreeEx QueryPerformanceCounter recvfrom GetCurrentThread Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; rv:11.0) like Gecko winsqlite3.dll GetModuleHandleExW GetUserNameW InternetConnectA IsBadReadPtr ReadConsoleA RegQueryInfoKeyA IsWow64Process GlobalMemoryStatusEx clock HeapFree GetVolumeInformationW GetDiskFreeSpaceExA SHUnicodeToAnsi CreateThread wsprintfA gdiplus.dll $CREEN.JPEG StretchBlt FCIDestroy ReleaseMutex GdipLoadImageFromFile Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 HTTP GdiplusStartup PathFileExistsA VirtualAllocEx ExitProcess GetExitCodeThread | |||||||||||||||
| 5720 | "C:\Users\admin\AppData\Local\Temp\/service123.exe" | C:\Users\admin\AppData\Local\Temp\service123.exe | — | svchost.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 6984 | "C:\Users\admin\AppData\Local\Temp\service123.exe" | C:\Users\admin\AppData\Local\Temp\service123.exe | Set-up.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
Total events
4 353
Read events
4 345
Write events
8
Delete events
0
Modification events
| (PID) Process: | (3812) Set-up.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (3812) Set-up.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (3812) Set-up.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (3812) Set-up.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3812 | Set-up.exe | C:\Users\admin\AppData\Local\Temp\service123.exe | — | |
MD5:— | SHA256:— | |||
| 3812 | Set-up.exe | C:\Users\admin\AppData\Local\Temp\NPfusbuzJWARBeSfnust.dll | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
28
DNS requests
12
Threats
5
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1492 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
3812 | Set-up.exe | POST | 200 | 185.244.181.38:80 | http://twoxv2pn.top/v1/upload.php | unknown | — | — | — |
3812 | Set-up.exe | POST | 200 | 185.244.181.38:80 | http://twoxv2pn.top/v1/upload.php | unknown | — | — | — |
3812 | Set-up.exe | POST | 200 | 185.244.181.38:80 | http://twoxv2pn.top/v1/upload.php | unknown | — | — | — |
4436 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
4436 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
7128 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 192.168.100.255:138 | — | — | — | whitelisted |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
3260 | svchost.exe | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3812 | Set-up.exe | 185.244.181.38:80 | twoxv2pn.top | Cloud assets LLC | RU | unknown |
1492 | svchost.exe | 40.126.32.68:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1492 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
7128 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4436 | SIHClient.exe | 40.127.169.103:443 | slscr.update.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
twoxv2pn.top |
| unknown |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
— | — | Potentially Bad Traffic | ET INFO HTTP Request to a *.top domain |
— | — | A Network Trojan was detected | ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 |
— | — | A Network Trojan was detected | ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 |
— | — | A Network Trojan was detected | ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 |