File name:

file

Full analysis: https://app.any.run/tasks/0d06a89a-141d-494f-8f30-10bc1dd9f03c
Verdict: Malicious activity
Threats:

Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth.

Malware Trends Tracker     >>>
Analysis date: August 07, 2023, 16:13:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
miner
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5:

CD686E0A36F98A589A63B87FED7696A0

SHA1:

A9FE498FDFEFFCBF583D56D2AF521DF365EEA534

SHA256:

B6718F85526F371A9E7BEF6D4728156BE869428B16D788718D11E32C94C61884

SSDEEP:

98304:0leOg5Yaa3EMLRZ6pT0cmeG0TZK9HpqC9TdhraGPwT7TRERN:00SEfpQneGWcJ9pHRwnTRAN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • powershell.exe (PID: 2884)
      • powershell.exe (PID: 2916)
      • powershell.exe (PID: 2392)
      • powershell.exe (PID: 2876)

    • Adds path to the Windows Defender exclusion list

      • explorer.exe (PID: 1880)

    • Application was injected by another process

      • services.exe (PID: 484)
      • IMEDICTUPDATE.EXE (PID: 1236)
      • svchost.exe (PID: 816)
      • svchost.exe (PID: 688)
      • conhost.exe (PID: 1268)
      • dwm.exe (PID: 1816)
      • svchost.exe (PID: 608)
      • svchost.exe (PID: 1204)
      • svchost.exe (PID: 328)
      • spoolsv.exe (PID: 300)
      • svchost.exe (PID: 1176)
      • svchost.exe (PID: 776)
      • lsass.exe (PID: 500)
      • svchost.exe (PID: 1052)
      • lsm.exe (PID: 508)
      • svchost.exe (PID: 844)
      • winlogon.exe (PID: 448)
      • wmpnetwk.exe (PID: 1700)
      • svchost.exe (PID: 884)
      • conhost.exe (PID: 2960)
      • conhost.exe (PID: 2828)
      • dllhost.exe (PID: 1384)
      • explorer.exe (PID: 1880)
      • svchost.exe (PID: 860)
      • taskeng.exe (PID: 3060)
      • conhost.exe (PID: 964)
      • conhost.exe (PID: 2020)
      • conhost.exe (PID: 2044)
      • conhost.exe (PID: 2668)
      • WmiPrvSE.exe (PID: 360)

    • Runs injected code in another process

      • dialer.exe (PID: 2504)
      • dialer.exe (PID: 1408)

    • Modifies hosts file to block updates

      • file.exe (PID: 1568)

    • Uses Task Scheduler to autorun other applications

      • powershell.exe (PID: 2916)
      • powershell.exe (PID: 2876)

    • Creates a writable file the system directory

      • svchost.exe (PID: 884)
      • powershell.exe (PID: 2392)

    • Uses Task Scheduler to run other applications

      • explorer.exe (PID: 1880)

    • MINER was detected

      • svchost.exe (PID: 328)

  • SUSPICIOUS

    • Script adds exclusion path to Windows Defender

      • explorer.exe (PID: 1880)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 1648)
      • cmd.exe (PID: 2036)

    • Reads the Internet Settings

      • powershell.exe (PID: 2884)

    • Starts CMD.EXE for commands execution

      • explorer.exe (PID: 1880)

    • Starts POWERSHELL.EXE for commands execution

      • explorer.exe (PID: 1880)

    • Executable content was dropped or overwritten

      • file.exe (PID: 1568)
      • updater.exe (PID: 2844)

    • Uses powercfg.exe to modify the power settings

      • cmd.exe (PID: 784)
      • cmd.exe (PID: 2532)

    • The process executes via Task Scheduler

      • updater.exe (PID: 2844)

    • Adds/modifies Windows certificates

      • services.exe (PID: 484)

    • Drops a system driver (possible attempt to evade defenses)

      • updater.exe (PID: 2844)

    • Creates or modifies Windows services

      • services.exe (PID: 484)

    • Unusual connection from system programs

      • powershell.exe (PID: 2392)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 2392)

    • Connects to unusual port

      • dialer.exe (PID: 2968)

  • INFO

    • The process checks LSA protection

      • lsass.exe (PID: 500)
      • dialer.exe (PID: 2504)
      • taskeng.exe (PID: 3060)
      • dialer.exe (PID: 1408)
      • dialer.exe (PID: 2968)
      • WmiPrvSE.exe (PID: 360)
      • svchost.exe (PID: 1052)

    • Checks supported languages

      • file.exe (PID: 1568)

    • Manual execution by a user

      • cmd.exe (PID: 1648)
      • cmd.exe (PID: 784)
      • powershell.exe (PID: 2884)
      • dialer.exe (PID: 2504)
      • powershell.exe (PID: 2916)
      • schtasks.exe (PID: 2420)
      • powershell.exe (PID: 2392)
      • cmd.exe (PID: 2036)
      • dialer.exe (PID: 2968)
      • powershell.exe (PID: 2876)
      • dialer.exe (PID: 772)
      • cmd.exe (PID: 2532)
      • dialer.exe (PID: 1408)

    • Create files in a temporary directory

      • file.exe (PID: 1568)

    • Creates files in the program directory

      • file.exe (PID: 1568)
      • updater.exe (PID: 2844)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

ProductVersion: 3,0,3,0
ProductName: VLC media player
LegalTrademark: VLC media player, VideoLAN and x264 are registered trademarks from VideoLAN
LegalCopyright: Copyright © 1996-2018 VideoLAN and VLC Authors
FileVersion: 3,0,3,0
FileDescription: VLC media player
FileTitle: vlc
CompanyName: VideoLAN
CharacterSet: Windows, Latin1
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Unknown
FileOS: Unknown (0)
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 3.0.3.0
FileVersionNumber: 3.0.3.0
Subsystem: Windows GUI
SubsystemVersion: 5.2
ImageVersion: -
OSVersion: 4
EntryPoint: 0x14b0
UninitializedDataSize: 11776
InitializedDataSize: 6015488
CodeSize: 125440
LinkerVersion: 2.38
PEType: PE32+
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, No debug
TimeStamp: 2023:08:07 13:19:32+00:00
MachineType: AMD AMD64

Summary

Architecture: IMAGE_FILE_MACHINE_AMD64
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 07-Aug-2023 13:19:32
Detected languages:
  • English - United States
TLS Callbacks: 2 callback(s) detected.
CompanyName: VideoLAN
FileTitle: vlc
FileDescription: VLC media player
FileVersion: 3,0,3,0
LegalCopyright: Copyright © 1996-2018 VideoLAN and VLC Authors
LegalTrademark: VLC media player, VideoLAN and x264 are registered trademarks from VideoLAN
ProductName: VLC media player
ProductVersion: 3,0,3,0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_AMD64
Number of sections: 11
Time date stamp: 07-Aug-2023 13:19:32
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00F0
Characteristics:
  • IMAGE_FILE_DEBUG_STRIPPED
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0001E8C0
0x0001EA00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.22663
.data
0x00020000
0x005956C0
0x00595800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.69942
.rdata
0x005B6000
0x00003DD0
0x00003E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.09023
.pdata
0x005BA000
0x000018CC
0x00001A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.12585
.xdata
0x005BC000
0x0000126C
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.71507
.bss
0x005BE000
0x00002CE0
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.idata
0x005C1000
0x00000A70
0x00000C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.94969
.CRT
0x005C2000
0x00000060
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.312494
.tls
0x005C3000
0x00000010
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x005C4000
0x00000738
0x00000800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.35433

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.22881
816
UNKNOWN
English - United States
RT_MANIFEST

Imports

KERNEL32.dll
msvcrt.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
79
Monitored processes
66
Malicious processes
10
Suspicious processes
5

Behavior graph

Click at the process to see the details
start inject inject inject inject inject inject inject inject inject inject inject inject file.exe powershell.exe cmd.exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs cmd.exe dialer.exe powershell.exe powercfg.exe no specs conhost.exe conhost.exe powercfg.exe no specs powercfg.exe no specs schtasks.exe no specs powercfg.exe no specs schtasks.exe conhost.exe updater.exe powershell.exe conhost.exe cmd.exe sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe sc.exe no specs sc.exe no specs cmd.exe dialer.exe powercfg.exe no specs powershell.exe winlogon.exe services.exe lsass.exe lsm.exe svchost.exe svchost.exe spoolsv.exe #MINER svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe imedictupdate.exe dllhost.exe wmpnetwk.exe dwm.exe explorer.exe conhost.exe taskeng.exe conhost.exe powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs schtasks.exe no specs dialer.exe dialer.exe wmiprvse.exe file.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Spooler SubSystem App
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\spoolsv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
328C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
360C:\Windows\system32\wbem\wmiprvse.exe -secured -EmbeddingC:\Windows\System32\wbem\WmiPrvSE.exe
svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Provider Host
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\wbem\wmiprvse.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
448winlogon.exeC:\Windows\System32\winlogon.exe
—
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Logon Application
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\winlogon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winsta.dll
484C:\Windows\system32\services.exeC:\Windows\System32\services.exe
wininit.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Services and Controller app
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\services.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\profapi.dll
c:\windows\system32\sechost.dll
c:\windows\system32\cryptbase.dll
500C:\Windows\system32\lsass.exeC:\Windows\System32\lsass.exe
wininit.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Local Security Authority Process
Exit code:
0
Version:
6.1.7601.23915 (win7sp1_ldr.170913-0600)
Modules
Images
c:\windows\system32\lsass.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspisrv.dll
c:\windows\system32\lsasrv.dll
c:\windows\system32\sechost.dll
c:\windows\system32\sspicli.dll
508C:\Windows\system32\lsm.exeC:\Windows\System32\lsm.exe
wininit.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Local Session Manager Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\lsm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sysntfy.dll
c:\windows\system32\wmsgapi.dll
c:\windows\system32\cryptbase.dll
608C:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpnpmgr.dll
c:\windows\system32\spinf.dll
c:\windows\system32\user32.dll
616"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"C:\Windows\System32\schtasks.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
688C:\Windows\system32\svchost.exe -k RPCSSC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\rpcepmap.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\secur32.dll
Total events
30 551
Read events
30 473
Write events
71
Delete events
7

Modification events

(PID) Process:(1880) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000088AF72B0747534094337F63DE35C94A000000000200000000001066000000010000200000004329E97B6122001987843D096C8D7A04278E955BA77E90F0EC21D5D5110C6099000000000E8000000002000020000000979BE7A559B305B7CFE1C5A5F5F59641FC60FE2130924CA918663525F927FE5F30000000D041206B4D7669F5545B3619830833DC14F9F449298E4B7C310BBBF83CEC0952F599785F4280E6066545B563DEA47E8A40000000E0D17684D5528603741776DB5671F0B8DF327589EF3FB4B1A699172343201C10052A85BDBE5A2A1E74B751F0F987A3DC9F48BA562021363FAF8E9C8FFE10450F
(PID) Process:(884) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3896776584-4254864009-862391680-1000
Operation:writeName:RefCount
Value:
10
(PID) Process:(884) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3896776584-4254864009-862391680-1000
Operation:writeName:RefCount
Value:
11
(PID) Process:(2884) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2884) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2884) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2884) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2884) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\155\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(884) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Performance
Operation:delete valueName:PerfMMFileName
Value:
Global\MMF_BITS_s
(PID) Process:(608) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Power\User\PowerSchemes
Operation:writeName:ActivePowerScheme
Value:
381b4222-f694-41f0-9685-ff5bb260df2e
Executable files
6
Suspicious files
14
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2884powershell.exeC:\Users\admin\AppData\Local\Temp\azwjj5vs.cv5.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1568file.exeC:\Program Files\Google\Chrome\updater.exeexecutable
MD5:CD686E0A36F98A589A63B87FED7696A0
SHA256:B6718F85526F371A9E7BEF6D4728156BE869428B16D788718D11E32C94C61884
1568file.exeC:\Windows\System32\drivers\etc\hoststext
MD5:4AC8A26E2CEE1347880EDCCB47AB30EA
SHA256:DE574C85B289F23BBA4B932A4C48397C4C61904CB6DF086726DD7F8049624C3A
2884powershell.exeC:\Users\admin\AppData\Local\Temp\301nh1pa.ux3.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2916powershell.exeC:\Users\admin\AppData\Local\Temp\v55ifiuz.xa1.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2392powershell.exeC:\Windows\TEMP\4xllkgxf.pkt.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2844updater.exeC:\Windows\TEMP\fncxdxvdacdk.tmpexecutable
MD5:658AC2968AC81EADBE165CFD2A770C34
SHA256:4F698FB3C8100837ACB42BEE30B7B0C362BCF6D3C617880BEDC86E1D57C25D11
2392powershell.exeC:\Windows\TEMP\xgszvohz.jd4.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
328svchost.exeC:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TarFC7F.tmpbinary
MD5:B1B258F645F1942199C34BDEF900295F
SHA256:54BF97EC19075163B6F11B32783364A50F8C73FE7F04F1C9EED75E9866BF020D
2392powershell.exeC:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:A2D5B8715C2A686570D13A7ACCA13A35
SHA256:9219CE6EC4495969AE46CA7AEFB7651C7CB80F546D2B7CDE2BCC2C62F7C9C63B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
4
DNS requests
3
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2392
powershell.exe
GET
304
67.27.159.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?311e35fd95b7d1c1
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
328
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2392
powershell.exe
67.27.159.126:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
2968
dialer.exe
139.99.102.73:10343
xmr-asia1.nanopool.org
OVH SAS
SG
malicious

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 67.27.159.126
  • 67.27.234.126
  • 8.241.121.254
  • 8.253.207.120
  • 8.253.204.120
whitelisted
xmr-asia1.nanopool.org
  • 139.99.102.70
  • 139.99.102.71
  • 139.99.101.197
  • 139.99.102.73
  • 103.3.62.64
  • 139.99.101.232
  • 139.99.101.198
  • 139.99.102.74
  • 172.104.165.191
  • 139.99.102.72
malicious
teredo.ipv6.microsoft.com
  • —
whitelisted

Threats

PID
Process
Class
Message
328
svchost.exe
Potential Corporate Privacy Violation
ET POLICY Observed DNS Query to Coin Mining Domain (nanopool .org)
No debug info