API tools faq
paste
paladin316

NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867_exe_2019-07-29_21_30.txt

paladin316
Jul 29th, 2019
2,173
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 42.09 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Nanocore"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe"
  7. * File Size: 1391074
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
  9. * SHA256: "74619922864d2354101e329f3f9079eb1b02b438545658c1ef9ac9300b42c033"
  10. * MD5: "f71d5c3d92723b79dc6bf3abd6bbe867"
  11. * SHA1: "db97f387bb4bab100229e9661c9465bb1a278961"
  12. * SHA512: "e4390314a4473b7db1063c11da9b8d19b29b4716ac1826756fda413aa381f05eae4d6401610e678369fff24ed02a813bdbbecc74150eb795381284b1d9c053cf"
  13. * CRC32: "42E5E1B9"
  14. * SSDEEP: "24576:bNA3R5drXTLPdn6B7QjOaP76KLiHMEhQkelZTv0dIjmFHDbeisNIfTKPWI0n:G5Pl6x1aP7AHEXKomx6IOPWIa"
  15.  
  16. * Process Execution:
  17. "NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe",
  18. "wscript.exe",
  19. "wim.exe",
  20. "wim.exe",
  21. "RegSvcs.exe",
  22. "schtasks.exe",
  23. "schtasks.exe",
  24. "svchost.exe",
  25. "WMIADAP.exe",
  26. "svchost.exe",
  27. "WmiPrvSE.exe",
  28. "svchost.exe"
  29.  
  30.  
  31. * Executed Commands:
  32. "\"C:\\Windows\\System32\\WScript.exe\" \"C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\jbb.vbs\"",
  33. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\jbb.vbs ",
  34. "\"C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\wim.exe\" trs=evu",
  35. "wim.exe trs=evu",
  36. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\wim.exe C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\RSECG",
  37. "\"schtasks.exe\" /create /f /tn \"DSL Subsystem\" /xml \"C:\\Users\\user\\AppData\\Local\\Temp\\tmp79B5.tmp\"",
  38. "\"schtasks.exe\" /create /f /tn \"DSL Subsystem Task\" /xml \"C:\\Users\\user\\AppData\\Local\\Temp\\tmp8407.tmp\"",
  39. "\\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE wmiadap.exe /F /T /R",
  40. "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding"
  41.  
  42.  
  43. * Signatures Detected:
  44.  
  45. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  46. "Details":
  47.  
  48. "IP": "192.169.69.25:20202"
  49.  
  50.  
  51.  
  52.  
  53. "Description": "Possible date expiration check, exits too soon after checking local time",
  54. "Details":
  55.  
  56. "process": "wim.exe, PID 2284"
  57.  
  58.  
  59.  
  60.  
  61. "Description": "Creates RWX memory",
  62. "Details":
  63.  
  64.  
  65. "Description": "Detected script timer window indicative of sleep style evasion",
  66. "Details":
  67.  
  68. "Window": "WSH-Timer"
  69.  
  70.  
  71.  
  72.  
  73. "Description": "A process attempted to delay the analysis task.",
  74. "Details":
  75.  
  76. "Process": "RegSvcs.exe tried to sleep 1164 seconds, actually delayed analysis time by 0 seconds"
  77.  
  78.  
  79. "Process": "svchost.exe tried to sleep 360 seconds, actually delayed analysis time by 0 seconds"
  80.  
  81.  
  82.  
  83.  
  84. "Description": "At least one IP Address, Domain, or File Name was found in a crypto call",
  85. "Details":
  86.  
  87. "ioc": "v2.0.50727"
  88.  
  89.  
  90.  
  91.  
  92. "Description": "Reads data out of its own binary image",
  93. "Details":
  94.  
  95. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00000000, length: 0x00000007"
  96.  
  97.  
  98. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00000000, length: 0x00002000"
  99.  
  100.  
  101. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00000007, length: 0x001539db"
  102.  
  103.  
  104. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00001ff0, length: 0x00002000"
  105.  
  106.  
  107. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00003fe0, length: 0x00002000"
  108.  
  109.  
  110. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00005fd0, length: 0x00002000"
  111.  
  112.  
  113. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00007fc0, length: 0x00002000"
  114.  
  115.  
  116. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00009fb0, length: 0x00002000"
  117.  
  118.  
  119. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x0000bfa0, length: 0x00002000"
  120.  
  121.  
  122. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x0000df90, length: 0x00002000"
  123.  
  124.  
  125. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x0000ff80, length: 0x00002000"
  126.  
  127.  
  128. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00011f70, length: 0x00002000"
  129.  
  130.  
  131. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00013f60, length: 0x00002000"
  132.  
  133.  
  134. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00015f50, length: 0x00002000"
  135.  
  136.  
  137. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00017f40, length: 0x00002000"
  138.  
  139.  
  140. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00019f30, length: 0x00002000"
  141.  
  142.  
  143. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x0001bf20, length: 0x00002000"
  144.  
  145.  
  146. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x0001df10, length: 0x00002000"
  147.  
  148.  
  149. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x0001ff00, length: 0x00002000"
  150.  
  151.  
  152. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00021ef0, length: 0x00002000"
  153.  
  154.  
  155. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00023ee0, length: 0x00002000"
  156.  
  157.  
  158. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00025ed0, length: 0x00002000"
  159.  
  160.  
  161. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00027ec0, length: 0x00002000"
  162.  
  163.  
  164. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00029eb0, length: 0x00002000"
  165.  
  166.  
  167. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x0002bea0, length: 0x00002000"
  168.  
  169.  
  170. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x0002de90, length: 0x00002000"
  171.  
  172.  
  173. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x0002fe80, length: 0x00002000"
  174.  
  175.  
  176. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00031e70, length: 0x00002000"
  177.  
  178.  
  179. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00033e60, length: 0x00002000"
  180.  
  181.  
  182. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00035e50, length: 0x00002000"
  183.  
  184.  
  185. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00037e40, length: 0x00002000"
  186.  
  187.  
  188. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00039e30, length: 0x00002000"
  189.  
  190.  
  191. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x0003be20, length: 0x00002000"
  192.  
  193.  
  194. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x0003de10, length: 0x00002000"
  195.  
  196.  
  197. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x0003fe00, length: 0x00002000"
  198.  
  199.  
  200. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00041df0, length: 0x00002000"
  201.  
  202.  
  203. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00043de0, length: 0x00002000"
  204.  
  205.  
  206. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00045dd0, length: 0x00002000"
  207.  
  208.  
  209. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00047dc0, length: 0x00002000"
  210.  
  211.  
  212. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00049db0, length: 0x00002000"
  213.  
  214.  
  215. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x0004bda0, length: 0x00002000"
  216.  
  217.  
  218. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x0004dd90, length: 0x00002000"
  219.  
  220.  
  221. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x0004fd80, length: 0x00002000"
  222.  
  223.  
  224. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00050a00, length: 0x00000031"
  225.  
  226.  
  227. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00050a19, length: 0x000ff380"
  228.  
  229.  
  230. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x0014ff66, length: 0x00000028"
  231.  
  232.  
  233. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00150163, length: 0x00000028"
  234.  
  235.  
  236. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00150335, length: 0x00000028"
  237.  
  238.  
  239. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00150507, length: 0x00000027"
  240.  
  241.  
  242. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00150710, length: 0x00000028"
  243.  
  244.  
  245. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x001508d7, length: 0x00000029"
  246.  
  247.  
  248. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00150ad6, length: 0x00000028"
  249.  
  250.  
  251. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00150c9e, length: 0x00000027"
  252.  
  253.  
  254. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00150e92, length: 0x00000028"
  255.  
  256.  
  257. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x001510a8, length: 0x00000028"
  258.  
  259.  
  260. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00151274, length: 0x00000028"
  261.  
  262.  
  263. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00151469, length: 0x00000028"
  264.  
  265.  
  266. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x0015166d, length: 0x00000028"
  267.  
  268.  
  269. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00151839, length: 0x00000028"
  270.  
  271.  
  272. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00151a36, length: 0x00000028"
  273.  
  274.  
  275. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00151c19, length: 0x00000028"
  276.  
  277.  
  278. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00151de9, length: 0x00000028"
  279.  
  280.  
  281. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00151fef, length: 0x00000029"
  282.  
  283.  
  284. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x001521e6, length: 0x00000028"
  285.  
  286.  
  287. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x001523d4, length: 0x00000028"
  288.  
  289.  
  290. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x001525b8, length: 0x00000027"
  291.  
  292.  
  293. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00152782, length: 0x00000028"
  294.  
  295.  
  296. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00152953, length: 0x00000028"
  297.  
  298.  
  299. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00152b5a, length: 0x00000028"
  300.  
  301.  
  302. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00152d4d, length: 0x00000028"
  303.  
  304.  
  305. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00152f45, length: 0x00000028"
  306.  
  307.  
  308. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x0015317f, length: 0x00000027"
  309.  
  310.  
  311. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x0015337e, length: 0x00000028"
  312.  
  313.  
  314. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00153562, length: 0x00000028"
  315.  
  316.  
  317. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00153741, length: 0x00000028"
  318.  
  319.  
  320. "self_read": "process: NanoCore_f71d5c3d92723b79dc6bf3abd6bbe867.exe, pid: 2000, offset: 0x00153923, length: 0x0000001b"
  321.  
  322.  
  323. "self_read": "process: wscript.exe, pid: 2944, offset: 0x00000000, length: 0x00000040"
  324.  
  325.  
  326. "self_read": "process: wscript.exe, pid: 2944, offset: 0x000000f0, length: 0x00000018"
  327.  
  328.  
  329. "self_read": "process: wscript.exe, pid: 2944, offset: 0x000001e8, length: 0x00000078"
  330.  
  331.  
  332. "self_read": "process: wscript.exe, pid: 2944, offset: 0x00018000, length: 0x00000020"
  333.  
  334.  
  335. "self_read": "process: wscript.exe, pid: 2944, offset: 0x00018058, length: 0x00000018"
  336.  
  337.  
  338. "self_read": "process: wscript.exe, pid: 2944, offset: 0x000181a8, length: 0x00000018"
  339.  
  340.  
  341. "self_read": "process: wscript.exe, pid: 2944, offset: 0x00018470, length: 0x00000010"
  342.  
  343.  
  344. "self_read": "process: wscript.exe, pid: 2944, offset: 0x00018640, length: 0x00000012"
  345.  
  346.  
  347. "self_read": "process: RegSvcs.exe, pid: 2964, offset: 0x00000000, length: 0x00001000"
  348.  
  349.  
  350. "self_read": "process: RegSvcs.exe, pid: 2964, offset: 0x00000080, length: 0x00000200"
  351.  
  352.  
  353. "self_read": "process: RegSvcs.exe, pid: 2964, offset: 0x00000178, length: 0x00000200"
  354.  
  355.  
  356. "self_read": "process: RegSvcs.exe, pid: 2964, offset: 0x00005b20, length: 0x00000200"
  357.  
  358.  
  359. "self_read": "process: RegSvcs.exe, pid: 2964, offset: 0x00005b3c, length: 0x00000200"
  360.  
  361.  
  362.  
  363.  
  364. "Description": "A process created a hidden window",
  365. "Details":
  366.  
  367. "Process": "RegSvcs.exe -> \"schtasks.exe\" /create /f /tn \"DSL Subsystem\" /xml \"C:\\Users\\user\\AppData\\Local\\Temp\\tmp79B5.tmp\""
  368.  
  369.  
  370. "Process": "RegSvcs.exe -> \"schtasks.exe\" /create /f /tn \"DSL Subsystem Task\" /xml \"C:\\Users\\user\\AppData\\Local\\Temp\\tmp8407.tmp\""
  371.  
  372.  
  373. "Process": "svchost.exe -> \\\\?\\C:\\Windows\\system32\\wbem\\WMIADAP.EXE"
  374.  
  375.  
  376.  
  377.  
  378. "Description": "Drops a binary and executes it",
  379. "Details":
  380.  
  381. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\wim.exe"
  382.  
  383.  
  384.  
  385.  
  386. "Description": "Executed a process and injected code into it, probably while unpacking",
  387. "Details":
  388.  
  389. "Injection": "wim.exe(800) -> RegSvcs.exe(2964)"
  390.  
  391.  
  392.  
  393.  
  394. "Description": "Attempts to remove evidence of file being downloaded from the Internet",
  395. "Details":
  396.  
  397. "file": "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe:Zone.Identifier"
  398.  
  399.  
  400.  
  401.  
  402. "Description": "Attempts to execute a Living Off The Land Binary command for post exeploitation",
  403. "Details":
  404.  
  405. "MITRE T1078 - schtask": "(Tactic: Execution, Persistence, Privilege Escalation)"
  406.  
  407.  
  408.  
  409.  
  410. "Description": "Installs itself for autorun at Windows startup",
  411. "Details":
  412.  
  413. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\qwertyuiuytrertyu.exe"
  414.  
  415.  
  416. "data": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\wim.exe C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\TRS_EV~1"
  417.  
  418.  
  419. "key": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\DSL Subsystem"
  420.  
  421.  
  422. "data": "C:\\Program Files (x86)\\DSL Subsystem\\dslss.exe"
  423.  
  424.  
  425.  
  426.  
  427. "Description": "Exhibits behavior characteristic of Nanocore RAT",
  428. "Details":
  429.  
  430.  
  431. "Description": "Creates a hidden or system file",
  432. "Details":
  433.  
  434. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\wim.exe"
  435.  
  436.  
  437. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\bmv.ppt"
  438.  
  439.  
  440. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\cni.docx"
  441.  
  442.  
  443. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\coc.icm"
  444.  
  445.  
  446. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\crc.pdf"
  447.  
  448.  
  449. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\cuj.mp3"
  450.  
  451.  
  452. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\dft.icm"
  453.  
  454.  
  455. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\dgc.ppt"
  456.  
  457.  
  458. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\djw.mp3"
  459.  
  460.  
  461. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\dnv.pdf"
  462.  
  463.  
  464. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\dqf.mp3"
  465.  
  466.  
  467. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\eqa.pdf"
  468.  
  469.  
  470. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\esu.pdf"
  471.  
  472.  
  473. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\frn.mp4"
  474.  
  475.  
  476. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\gas.xl"
  477.  
  478.  
  479. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\gde.mp3"
  480.  
  481.  
  482. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\gkl.txt"
  483.  
  484.  
  485. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\gmi.mp4"
  486.  
  487.  
  488. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\gxr.dat"
  489.  
  490.  
  491. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\heg.bmp"
  492.  
  493.  
  494. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\hgj.pdf"
  495.  
  496.  
  497. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\hik.docx"
  498.  
  499.  
  500. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\hsg.mp3"
  501.  
  502.  
  503. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\ifv.dat"
  504.  
  505.  
  506. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\ikd.mp3"
  507.  
  508.  
  509. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\iqv.jpg"
  510.  
  511.  
  512. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\itd.ppt"
  513.  
  514.  
  515. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\jbb.vbs"
  516.  
  517.  
  518. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\kug.mp3"
  519.  
  520.  
  521. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\lhp.xl"
  522.  
  523.  
  524. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\lmh.bmp"
  525.  
  526.  
  527. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\luu.jpg"
  528.  
  529.  
  530. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\nan.dat"
  531.  
  532.  
  533. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\nhk.ico"
  534.  
  535.  
  536. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\qjm.docx"
  537.  
  538.  
  539. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\qmt.txt"
  540.  
  541.  
  542. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\qql.xl"
  543.  
  544.  
  545. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\rdo.bmp"
  546.  
  547.  
  548. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\rif.xl"
  549.  
  550.  
  551. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\rte.icm"
  552.  
  553.  
  554. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\rvu.mp4"
  555.  
  556.  
  557. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\sxd.bmp"
  558.  
  559.  
  560. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\tah.mp3"
  561.  
  562.  
  563. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\tgh.mp3"
  564.  
  565.  
  566. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\trs=evu"
  567.  
  568.  
  569. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\ufs.dat"
  570.  
  571.  
  572. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\uwe.docx"
  573.  
  574.  
  575. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\vjf.pdf"
  576.  
  577.  
  578. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\wnh.txt"
  579.  
  580.  
  581. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\wuu.ico"
  582.  
  583.  
  584. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\xhl.mp4"
  585.  
  586.  
  587. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\xxk.mp4"
  588.  
  589.  
  590. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\41802843"
  591.  
  592.  
  593.  
  594.  
  595. "Description": "File has been identified by 38 Antiviruses on VirusTotal as malicious",
  596. "Details":
  597.  
  598. "MicroWorld-eScan": "Trojan.GenericKD.32163547"
  599.  
  600.  
  601. "McAfee": "Artemis!F71D5C3D9272"
  602.  
  603.  
  604. "Alibaba": "Trojan:Win32/Starter.ali2000005"
  605.  
  606.  
  607. "K7GW": "Riskware ( 0040eff71 )"
  608.  
  609.  
  610. "K7AntiVirus": "Riskware ( 0040eff71 )"
  611.  
  612.  
  613. "Arcabit": "Trojan.Generic.D1EAC6DB"
  614.  
  615.  
  616. "Symantec": "Trojan.Gen.MBT"
  617.  
  618.  
  619. "ESET-NOD32": "Win32/Injector.Autoit.EDE"
  620.  
  621.  
  622. "APEX": "Malicious"
  623.  
  624.  
  625. "Avast": "Win32:Malware-gen"
  626.  
  627.  
  628. "ClamAV": "Win.Malware.0040eff-7058212-0"
  629.  
  630.  
  631. "Kaspersky": "Trojan.Win32.NanoBot.mov"
  632.  
  633.  
  634. "BitDefender": "Trojan.GenericKD.32163547"
  635.  
  636.  
  637. "Tencent": "Win32.Trojan.Nanobot.Ebgn"
  638.  
  639.  
  640. "Ad-Aware": "Trojan.GenericKD.32163547"
  641.  
  642.  
  643. "Emsisoft": "Trojan.GenericKD.32163547 (B)"
  644.  
  645.  
  646. "Comodo": "Malware@#g33djwg9i0gx"
  647.  
  648.  
  649. "Invincea": "heuristic"
  650.  
  651.  
  652. "McAfee-GW-Edition": "BehavesLike.Win32.Backdoor.tc"
  653.  
  654.  
  655. "FireEye": "Generic.mg.f71d5c3d92723b79"
  656.  
  657.  
  658. "Sophos": "Mal/Generic-S"
  659.  
  660.  
  661. "Paloalto": "generic.ml"
  662.  
  663.  
  664. "Cyren": "W32/Trojan.JYTG-5424"
  665.  
  666.  
  667. "Avira": "TR/AD.Nanocore.zzzlv"
  668.  
  669.  
  670. "Microsoft": "Trojan:Win32/Occamy.C"
  671.  
  672.  
  673. "Endgame": "malicious (high confidence)"
  674.  
  675.  
  676. "ZoneAlarm": "Trojan.Win32.NanoBot.mov"
  677.  
  678.  
  679. "GData": "Trojan.GenericKD.32163547"
  680.  
  681.  
  682. "AhnLab-V3": "Trojan/Win32.RL_Agent.R273974"
  683.  
  684.  
  685. "ALYac": "Trojan.GenericKD.32163547"
  686.  
  687.  
  688. "MAX": "malware (ai score=59)"
  689.  
  690.  
  691. "Zoner": "Probably RARAutorun"
  692.  
  693.  
  694. "TrendMicro-HouseCall": "TROJ_GEN.R002C0WGJ19"
  695.  
  696.  
  697. "Fortinet": "AutoIt/Injector.EDE!tr"
  698.  
  699.  
  700. "AVG": "Win32:Malware-gen"
  701.  
  702.  
  703. "Cybereason": "malicious.7bb4ba"
  704.  
  705.  
  706. "CrowdStrike": "win/malicious_confidence_80% (W)"
  707.  
  708.  
  709. "Qihoo-360": "Win32/Trojan.BO.73b"
  710.  
  711.  
  712.  
  713.  
  714. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  715. "Details":
  716.  
  717. "target": "clamav:Win.Malware.0040eff-7058212-0, sha256:74619922864d2354101e329f3f9079eb1b02b438545658c1ef9ac9300b42c033, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  718.  
  719.  
  720.  
  721.  
  722. "Description": "Collects information to fingerprint the system",
  723. "Details":
  724.  
  725.  
  726. "Description": "Created network traffic indicative of malicious activity",
  727. "Details":
  728.  
  729. "signature": "ET TROJAN Possible NanoCore C2 60B"
  730.  
  731.  
  732.  
  733.  
  734.  
  735. * Started Service:
  736.  
  737. * Mutexes:
  738. "DefaultTabtip-MainUI",
  739. "CicLoadWinStaWinSta0",
  740. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  741. "Local\\ZoneAttributeCacheCounterMutex",
  742. "Local\\ZonesCacheCounterMutex",
  743. "Local\\ZonesLockedCacheCounterMutex",
  744. "Global\\CLR_CASOFF_MUTEX",
  745. "Global\\0e9f044e-5c49-4702-bfa3-2880805abe42",
  746. "Global\\.net clr networking",
  747. "Global\\ADAP_WMI_ENTRY",
  748. "Global\\RefreshRA_Mutex",
  749. "Global\\RefreshRA_Mutex_Lib",
  750. "Global\\RefreshRA_Mutex_Flag"
  751.  
  752.  
  753. * Modified Files:
  754. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\__tmp_rar_sfx_access_check_15823000",
  755. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\dqf.mp3",
  756. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\trs=evu",
  757. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\jbb.vbs",
  758. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\wim.exe",
  759. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\frn.mp4",
  760. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\uwe.docx",
  761. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\qjm.docx",
  762. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\qmt.txt",
  763. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\ifv.dat",
  764. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\heg.bmp",
  765. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\dnv.pdf",
  766. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\nan.dat",
  767. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\rdo.bmp",
  768. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\coc.icm",
  769. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\esu.pdf",
  770. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\dgc.ppt",
  771. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\dft.icm",
  772. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\cuj.mp3",
  773. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\hsg.mp3",
  774. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\gkl.txt",
  775. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\wnh.txt",
  776. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\xhl.mp4",
  777. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\wuu.ico",
  778. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\ufs.dat",
  779. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\tgh.mp3",
  780. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\lhp.xl",
  781. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\bmv.ppt",
  782. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\cni.docx",
  783. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\djw.mp3",
  784. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\qql.xl",
  785. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\lmh.bmp",
  786. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\vjf.pdf",
  787. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\eqa.pdf",
  788. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\gmi.mp4",
  789. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\gxr.dat",
  790. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\nhk.ico",
  791. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\crc.pdf",
  792. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\rte.icm",
  793. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\ikd.mp3",
  794. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\hik.docx",
  795. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\xxk.mp4",
  796. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\rvu.mp4",
  797. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\gas.xl",
  798. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\iqv.jpg",
  799. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\itd.ppt",
  800. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\gde.mp3",
  801. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\kug.mp3",
  802. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\hgj.pdf",
  803. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\rif.xl",
  804. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\sxd.bmp",
  805. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\luu.jpg",
  806. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\tah.mp3",
  807. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\RSECG",
  808. "C:\\Users\\user\\AppData\\Roaming\\C1515A12-1764-4632-ACE9-A9DFF9253200\\run.dat",
  809. "C:\\Program Files (x86)\\DSL Subsystem\\dslss.exe",
  810. "C:\\Users\\user\\AppData\\Local\\Temp\\tmp79B5.tmp",
  811. "C:\\Users\\user\\AppData\\Roaming\\C1515A12-1764-4632-ACE9-A9DFF9253200\\task.dat",
  812. "C:\\Users\\user\\AppData\\Local\\Temp\\tmp8407.tmp",
  813. "C:\\Windows\\sysnative\\Tasks\\DSL Subsystem",
  814. "C:\\Windows\\sysnative\\Tasks\\DSL Subsystem Task",
  815. "\\Device\\LanmanDatagramReceiver",
  816. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
  817. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  818. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
  819. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h",
  820. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  821. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.ini",
  822. "\\??\\PIPE\\samr",
  823. "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
  824. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
  825. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
  826. "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
  827. "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
  828. "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
  829. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
  830. "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
  831. "\\??\\WMIDataDevice"
  832.  
  833.  
  834. * Deleted Files:
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\__tmp_rar_sfx_access_check_15823000",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\41802843\\RSECG",
  837. "C:\\Program Files (x86)\\DSL Subsystem\\dslss.exe",
  838. "C:\\Users\\user\\AppData\\Roaming\\C1515A12-1764-4632-ACE9-A9DFF9253200\\DSL Subsystem\\dslss.exe",
  839. "C:\\Users\\user\\AppData\\Local\\Temp\\tmp79B5.tmp",
  840. "C:\\Users\\user\\AppData\\Local\\Temp\\tmp8407.tmp",
  841. "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe:Zone.Identifier",
  842. "C:\\Windows\\Tasks\\DSL Subsystem.job",
  843. "C:\\Windows\\Tasks\\DSL Subsystem Task.job",
  844. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MpIdleTask",
  845. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
  846. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log",
  847. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl.h",
  848. "C:\\Windows\\sysnative\\wbem\\Performance\\WmiApRpl_new.h"
  849.  
  850.  
  851. * Modified Registry Keys:
  852. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\UNCAsIntranet",
  853. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\AutoDetect",
  854. "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\MuiCache\\2F\\52C64B7E\\LanguageList",
  855. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\qwertyuiuytrertyu.exe",
  856. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\DSL Subsystem",
  857. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\1CDD8E4B-9C11-4A5C-B274-BF91E107038D\\Path",
  858. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\1CDD8E4B-9C11-4A5C-B274-BF91E107038D\\Hash",
  859. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\DSL Subsystem\\Id",
  860. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\DSL Subsystem\\Index",
  861. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\1CDD8E4B-9C11-4A5C-B274-BF91E107038D\\Triggers",
  862. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\E0FA044E-120E-427D-A5EE-A3C2A235D445\\Path",
  863. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\E0FA044E-120E-427D-A5EE-A3C2A235D445\\Hash",
  864. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\DSL Subsystem Task\\Id",
  865. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\DSL Subsystem Task\\Index",
  866. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\E0FA044E-120E-427D-A5EE-A3C2A235D445\\Triggers",
  867. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  868. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\PreviousServiceShutdown",
  869. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
  870. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\F6F51815-5381-4CB4-A2F8-7A279A2B2025\\Path",
  871. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\F6F51815-5381-4CB4-A2F8-7A279A2B2025\\Hash",
  872. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Id",
  873. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Index",
  874. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\F6F51815-5381-4CB4-A2F8-7A279A2B2025\\Triggers",
  875. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\F6F51815-5381-4CB4-A2F8-7A279A2B2025\\DynamicInfo",
  876. "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
  877. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
  878. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
  879. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
  880. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
  881. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
  882. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider",
  883. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\IDE\\DiskVBOX_HARDDISK___________________________1.0_____\\5&33d1638a&0&0.0.0_0-00000000-0000-0000-0000-000000000000",
  884. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\advapi32.dllMofResourceName",
  885. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\en-US\\advapi32.dll.muiMofResourceName",
  886. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ACPI.sysACPIMOFResource",
  887. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ACPI.sys.muiACPIMOFResource",
  888. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\ndis.sysMofResourceName",
  889. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\drivers\\en-US\\ndis.sys.muiMofResourceName",
  890. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\mssmbios.sysMofResource",
  891. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\mssmbios.sys.muiMofResource",
  892. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\HDAudBus.sysHDAudioMofName",
  893. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\HDAudBus.sys.muiHDAudioMofName",
  894. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\intelppm.sysPROCESSORWMI",
  895. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\en-US\\intelppm.sys.muiPROCESSORWMI",
  896. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\portcls.SYSPortclsMof",
  897. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\System32\\Drivers\\en-US\\portcls.SYS.muiPortclsMof",
  898. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sysMonitorWMI"
  899.  
  900.  
  901. * Deleted Registry Keys:
  902. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  903. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProxyBypass",
  904. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  905. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\IntranetName",
  906. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\DSL Subsystem.job",
  907. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\DSL Subsystem.job.fp",
  908. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\DSL Subsystem Task.job",
  909. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\CompatibilityAdapter\\Signatures\\DSL Subsystem Task.job.fp",
  910. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
  911. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\WDM\\C:\\Windows\\system32\\DRIVERS\\monitor.sysMonitorWMI"
  912.  
  913.  
  914. * DNS Communications:
  915.  
  916. "type": "A",
  917. "request": "benzkartel.duckdns.org",
  918. "answers":
  919.  
  920. "data": "192.169.69.25",
  921. "type": "A"
  922.  
  923.  
  924.  
  925.  
  926.  
  927. * Domains:
  928.  
  929. "ip": "192.169.69.25",
  930. "domain": "benzkartel.duckdns.org"
  931.  
  932.  
  933.  
  934. * Network Communication - ICMP:
  935.  
  936. * Network Communication - HTTP:
  937.  
  938. * Network Communication - SMTP:
  939.  
  940. * Network Communication - Hosts:
  941.  
  942. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!