top title background image
flash

http://www.blogger.com/feeds/1029833275466591797/posts/default?callback=jQuery33109228766052246996_1593689427253&_=1593689427254

Status: finished
Submission Time: 2020-07-02 18:41:10 +02:00
Malicious
Ransomware
Trojan
Evader
Miner
Remcos AdWind

Comments

Tags

Details

  • Analysis ID:
    242991
  • API (Web) ID:
    381688
  • Analysis Started:
    2020-07-02 18:41:11 +02:00
  • Analysis Finished:
    2020-07-02 18:45:33 +02:00
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 76
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Domains

Name IP Detection
www.blogger.com
0.0.0.0

URLs

Name Detection
https://blog.talosintelligen
https://blog.tal
https://blog.talosintelligence.com/2020/07/valak-emerges.html
Click to see the 97 hidden entries
https://blog.talosintelligence.com/2020/07/valak-emerges.html#comment-form
https://1.bp.blogspot.com/-BcZUGzrlofI/XvoJOKfk1wI/AAAAAAAAAoY/kGmYgVFjoeg_9nu7YikPRvxGcFe5mAR_wCK4B
https://1.bp.b
https://www.axios.com/russian-interference-2020-election-racial-injustice-7fa6a49b-03b4-4dc6-898d-fa
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0971
https://1.bp.blogspot.com/-jslK2s86AI8/XvA9lQeJZyI/AAAAAAAAAIE/Vt7uQRWhHa0wCnXulrhdeKOjza6gTAaKgCLcB
https://1.bp.blogspot.com/-KHKeKdmjgOk/XuQD1pSKEBI/AAAAAAAAEGs/ZFkd0uaNZNw15NxF4u-r23B38vcqhPF
https://blog.talosintelligence.com/2020/04/IR-quarterly-threat-report-spring-2020.html
https://www.virustotal.com/gui/file/85b936960fbe5100c170b777e1647ce9f0f01e3ab9742dfc23f37cb0825b30b5
https://1.bp.blogspot.com/-M12iKHVAeUM/XtqrAPzZsiI/AAAAAAAAED8/edunoFhDZ7olS08Iow7b4kWHqqCbP3yAwCLcB
https://blog.talosintelligence.com/2020/06/threat-roundup-0619-0626.html#comment-form
https://1.bp.blogspot.com/-EIFVehRqjmk/XtqrcAXsE7I/AAAAAAAAEEQ/66CRhWtkjxctD49HHZgaNTzM_aoiO29vgCLcB
https://www.virustotal.com/gui/file/8bf5d91950033ef6f40ffbd2340d8b0add0ffdcbbb4cfd309218d6d0810d85be
https://blog.talosintelligence.com/feeds/1944059801554374349/comments/default
https://www.cisco.com/c/en/us/products/security/intrusion-prevention-system-ips/index.html
https://1.bp.blogspot.com/-E9okXstDSBQ/Xtqh5ogkT9I/AAAAA
https://arstechnica.com/tech-policy/2020/06/researchers-say-online-voting-tech-used-in-5-states-is-f
https://twitter.c
https://www.blogger.com/feeds/1029833275466591797/posts/default/8211641079411470424
https://lh4.googleusercontent.com/58mJ2vD66Gu_CjHs-sehwJx2_KbDdlzx7ogzN0ag-5ejqH4flnVNEnsY-BP7Vj1Pmy
https://blog.talosintelligence.com/feeds/9149098576402283789/comments/default
https://1.b
https://open.spotify.com/show/0KUi5HIbOUJNRD3LTpkWUV?si=jM8eLezASdaQYkexalJGRA
https://1.bp.blogspot.com/-j6KT9w8g9Mg/Xtq
https://blog.talosintelligence.com/2020/06/threat-source-newsletter-for-june-4-2020.html
https://1.bp.blogspot.com/-cvDvPu2I98c/XvA_gINsd_I/AAAAAAAAAJY/1hs3SBgzQl44DezfHpFAVglyAzR1TqiyACLcB
https://www.cisco.com/c/en/us/products/secur
https://www.blogger.com/feeds/1029833275466591797/posts/default/5289141637105922741
https://www.blogger.com/feeds/1029833275466591797/posts/default/8768850145256010662
https://blog.talosintelligence.com/feeds/4476305617220352306/comments/default
https://www.blogger.com/feeds/1029833275466591797/posts/default/9149098576402283789
https://1.bp.blogspot.com/-tRIv0Sbf_5k/XtqtYBTR-sI/AAAAAAAAEE8/RR80ZHM6SRgknc1c8PmIgwvioKe7VIPZwCLcB
http://1.bp.blogspot.com/-BcZUGzrlofI/XvoJOKfk1wI/AAAAAAAAAoY/kGmYgVFjoeg_9nu7YikPRvxGcFe5mAR_wCK4BG
https://new.siemens.com/global/en/products/services/cert.html
https://blog.talosintelligence.com/2020/06/beers-with-talos-ep-84-mid-career.html#comment-form
https://3.bp.blogspot.com/-_zk1EeV09Kk/XvoID86XbkI/AAAAAAAAAnc/VsaKgyu2fYMCbg23SnPiCIjWS1EIPpNMACK4B
https://nvidia.custhelp.com/app/answers/detail/a_id/5031
https://twitter.com/r00tbsd?lang%3Den
https://1.bp.blogspot.com/-Vz9qM3DHJvk/XvZLGjRYxAI/AAAAAAAAEL4/shBl6oLjl_w1CdgbobuCd8mTaX545gRQQCLcB
https://www.wsj.com/articles/irs-used-cellphone-location-data-to-try-to-find-suspects-11592587815
https://4.bp.blogspot.com/-HxgZBuqfyB
https://4.bp.blogspot.
https://www.virustotal.com/gui/file/c3e530cc005583b47322b6649ddc0dab1b64bcf22b124a492606763c52fb048f
https://twitter.com/kpyke
https://lh6.googleusercontent.com/1-4YUKsdu70viiao3Dnw7siah4EHsIs9xDHvj_dG8AKtC-xm4RybDxxQWCtsQoxwto
https://cybersecurity.att.com/blogs/labs-research/newly-identified-strongpity-operations
https://www.blogger.com/feeds/1029833275466591797/posts/default/5405009450077296728
https://1.bp.blogspot.com/-IjStNZfvols/XvyOCcD9DzI/AAAAAAAABvU/lLQIQJtbSL4AW72nPvBhXiKL7KFIHxcuACLcB
https://www.talosintelligence.com/assets/icon_check_white
https://4.bp.blogspot.com/-Umk3wMXO_kw/XvoJqZdSrjI/AAAAAAAAAos/3dzM7-wgdYcPrOGpHwWGO5yXUSp5N9QEwCK4B
https://blog.talosintelligence.com/2020/06/CTIR-tr
https://1.bp.blogspot.com/-E9okXstDSBQ/Xtqh5ogkT9I/AAAAAAAAECE/kBerHABxDR0KbwjwDzHrmCncEdJTlt4wACLcB
https://www.virustotal.com/gui/file/85b936960fbe5100c170b777e1647ce9
https://blog.talosintelligence.com/2018/08/picking-apart-remcos.html
https://www.sans.org/event/digital-forensics-summit-2020/summit-agenda?msc=home
https://1.bp.blogspot.com/-o4kOj_DEZb8/XvA-5-p8AXI/AAAAAAAAAI0/hA08owbl7IUcHo4FmFsWmWdPtS3AxT0KACLcB
https://www.virustotal.com/gui/file/e3eeaee0af4b549eae4447fa20cfe205e8d56beecf43cf14a11bf3e86ae6e8bd
https://lh3.googleusercontent.com/dkvZ5Y8umlrjReT1FON-M1R4Oe87Ffnyk9DW1IdNjyXh6pU4jHEQb2A40t2dWTGs3I
https://www.youtube.com/channel/UCg-_lYeV8hBnDSay7nmphUA
https://1.bp.blogspot.com/-xKTrZXuPDkk/XuQHs8cqFlI/AAAAAAAAEJQ/98Dk9MScGfUVHgyNmyyvNat91HtmWmpBwCLcB
http://blog.talosintelligence.com/
https://blog.talosintelligence.com/2020/06/microsoft-patch-tuesday-for-june-2020.html#comment-form
https://1.bp.blogspot.com/-tsowpPGiQzY/XvyM-lZAEfI/AAAAAAAABuQ/UD5fMoAxSd
https://1.bp.blogspot.com/-JXkSIehaKi4/XUgwEX6wLjI/AAAAAAAAAC8/8mea4rZfy7AGT_PIchejkERmCFmfdbxTACPcB
https://www.cisco.com/c/en/us/products/security/cl
https://1.bp.blogspot.com/-HyePFqZZ790/XvyNemFVnXI/AAAAAAAABu8/ru49vFsnUKwl6yUFU-Z8BM09VWBTN9mbQCLcB
https://1.bp.blogspot.com/-DhrT5ri_73Y/XtqqbkcYcYI/AAAAAAAAEDo/M-EOhLGc7b4dvSf_NiquiVZxz9DQ5ApTgCLcB
https://twitter.com/emd3l
https://blog.talosintelligence.com/feeds/4207084517472454952/
https://www.blogger.com
https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/092/612/origina
https://www.techradar.com/news/windows-10-security-alert-users-warned-over-wormable-bug
https://1.bp.blogspot.com/-9jf-e0DHHeY/XtqhYVAwl7I/AAAAAAAAEBo/70SkrW_aCkM-b-ewXXrctws7ruIkafAwACLcB
https://www.talosintelligence.com/assets/icon_check_white.s
https://1.bp.blogspot.com/-18bFD4yIZns/XuQHS8kqy6I/AAAAAAAAEI8/c5vnLHZTM8UBKnKeoRwI-8eyNdVw-vzZgCLcB
https://blog.talosintelligence.com/2020/06/microsoft-patch-tuesday-for-june-2020.html
https://www.vice.com/en_us/article/y3zwgg/discord-servers-onlyfans-leak-pirating-porn
https://blog.talosintelligence.com/feeds/3991760122001392172/comments/default
https://twitter.com/clamav?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor
https://twitter.com/chinahanddave?lang=en
https://newsroom.ibm.com/2020-06-22-IBM-Security-
https://1.bp.blogspot.com/--8tq4q6mpQI/XuQDT7qHPGI/AAAAAAAAEGU/bot6IzmESOQWLeCfxbqi5Hol9MSxL3IJACLcB
https://github.com/Cisco-Talos/osquery_queries/blob/master/win_malware/malware_indigodrop_filepath.y
https://blog.talosintelligence.com/2020/06/vuln-spotlight-zoom-code-execution-june-2020.html
https://1.bp.blogspot.com/-N_NWeJsuo7M/XvA_4UlPPpI
http://3.bp.blogspot.com/-_zk1EeV09Kk/XvoID86XbkI/AAAAAAAAAnc/VsaKgyu2fYMCbg23SnPiCIjWS1EIPpNMACK4BG
https://www.talosintelligence.com/assets/icon_check_whit
https://1.bp.blogspot.com/-N_NWeJsuo7M/XvA_4UlPPpI/AAA
https://www.stitcher.com/podcast/talos/beers-with-talos
http://a9.com/-/spec/opensearchrss
https://blog.talosintelligence.com/feeds/8768850145256010662/comments/default
https://blog.talosintelligence.com/2020/04/azorult-brings-friends-to-party.html
https://storage.googlea
https://www.anomali.com/blog/anomali-threat-research-identifies-fake-covid-19-contact-tracing-apps-u
https://tools.cisco.com/security/center/publicationListing.x
https://www.blogger.com/feeds/1029833275466591797/posts/default/2378353192882671445
https://blog.talosintelligence.com/feeds/4207084517472454952/comments/default

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5497CD72-BCCE-11EA-AADE-C25F135D3C65}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5497CD74-BCCE-11EA-AADE-C25F135D3C65}.dat
Microsoft Word Document
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\KSU5XQMC\default[1].htm
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
#
Click to see the 7 hidden entries
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\V5D02472\default.js.2o5kiwh.partial
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\V5D02472\default.js.2o5kiwh.partial:Zone.Identifier
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\V5D02472\default.js:Zone.Identifier
very short file (no magic)
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VINVDFP6\default[1].js
data
#
C:\Users\user\AppData\Local\Temp\JavaDeployReg.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\~DF51B1615B056CA332.TMP
data
#
C:\Users\user\AppData\Local\Temp\~DF6617A4294DF7FA32.TMP
data
#