Cuckoo 3 - Task

Task report

Results of individual task ran during analysis.

Task Settings Machine

Task

4_/10

Task score

20240609-RN6BY1_1 Reported

Data_20231118.Elab.txt

2024-06-09 14:13
20.5 kB
text/plain

Signatures

Description

Drops file in Windows directory

2 IOC's.

description	process	process_id	value
Opened file for modifying	svchost.exe	73	C:\Windows\Debug\ESE.TXT
Opened file for modifying	svchost.exe	73	C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Processes

Screenshots

Drag slider to view screenshots

Network analysis

Hosts network communicated with.

/4 results

192.168.30.255
8.8.4.4
8.8.8.8
239.255.255.250
No results

List of UDP communications.

From: 192.168.30.10:137

To: 192.168.30.255:137

Size 68 bytes

From: 192.168.30.10:137

To: 192.168.30.255:137

Size 68 bytes

From: 192.168.30.10:137

To: 192.168.30.255:137

Size 68 bytes

From: 192.168.30.10:137

To: 192.168.30.255:137

Size 68 bytes

From: 192.168.30.10:137

To: 192.168.30.255:137

Size 68 bytes

From: 192.168.30.10:137

To: 192.168.30.255:137

Size 68 bytes

From: 192.168.30.10:50843

To: 8.8.4.4:53

Size 30 bytes

From: 192.168.30.10:137

To: 192.168.30.255:137

Size 68 bytes

From: 192.168.30.10:137

To: 192.168.30.255:137

Size 68 bytes

From: 192.168.30.10:50843

To: 8.8.8.8:53

Size 30 bytes

From: 192.168.30.10:50843

To: 8.8.4.4:53

Size 30 bytes

From: 192.168.30.10:137

To: 192.168.30.255:137

Size 68 bytes

From: 192.168.30.10:137

To: 192.168.30.255:137

Size 68 bytes

From: 192.168.30.10:138

To: 192.168.30.255:138

Size 182 bytes

From: 192.168.30.10:138

To: 192.168.30.255:138

Size 201 bytes

From: 192.168.30.10:138

To: 192.168.30.255:138

Size 182 bytes

From: 192.168.30.10:50843

To: 8.8.8.8:53

Size 30 bytes

From: 192.168.30.10:50843

To: 8.8.4.4:53

Size 30 bytes

From: 192.168.30.10:138

To: 192.168.30.255:138

Size 182 bytes

From: 192.168.30.10:138

To: 192.168.30.255:138

Size 182 bytes

From: 192.168.30.10:138

To: 192.168.30.255:138

Size 194 bytes

From: 192.168.30.10:59518

To: 8.8.8.8:53

Size 34 bytes

From: 192.168.30.10:138

To: 192.168.30.255:138

Size 194 bytes

From: 192.168.30.10:59518

To: 8.8.4.4:53

Size 34 bytes

From: 192.168.30.10:138

To: 192.168.30.255:138

Size 194 bytes

From: 192.168.30.10:59518

To: 8.8.4.4:53

Size 34 bytes

From: 192.168.30.10:138

To: 192.168.30.255:138

Size 194 bytes

From: 192.168.30.10:137

To: 192.168.30.255:137

Size 68 bytes

From: 192.168.30.10:59518

To: 8.8.8.8:53

Size 34 bytes

From: 192.168.30.10:59518

To: 8.8.4.4:53

Size 34 bytes

From: 192.168.30.10:137

To: 192.168.30.255:137

Size 68 bytes

From: 192.168.30.10:137

To: 192.168.30.255:137

Size 68 bytes

From: 192.168.30.10:137

To: 192.168.30.255:137

Size 68 bytes

From: 192.168.30.10:137

To: 192.168.30.255:137

Size 68 bytes

From: 192.168.30.10:137

To: 192.168.30.255:137

Size 68 bytes

From: 192.168.30.10:59518

To: 8.8.8.8:53

Size 34 bytes

From: 192.168.30.10:59518

To: 8.8.4.4:53

Size 34 bytes

From: 192.168.30.10:137

To: 192.168.30.255:137

Size 68 bytes

From: 192.168.30.10:137

To: 192.168.30.255:137

Size 68 bytes

From: 192.168.30.10:138

To: 192.168.30.255:138

Size 182 bytes

From: 192.168.30.10:138

To: 192.168.30.255:138

Size 182 bytes

From: 192.168.30.10:138

To: 192.168.30.255:138

Size 212 bytes

From: 192.168.30.10:57286

To: 8.8.8.8:53

Size 34 bytes

From: 192.168.30.10:57286

To: 8.8.4.4:53

Size 34 bytes

From: 192.168.30.10:57286

To: 8.8.4.4:53

Size 34 bytes

From: 192.168.30.10:138

To: 192.168.30.255:138

Size 201 bytes

From: 192.168.30.10:57286

To: 8.8.8.8:53

Size 34 bytes

From: 192.168.30.10:57286

To: 8.8.4.4:53

Size 34 bytes

From: 192.168.30.10:57286

To: 8.8.8.8:53

Size 34 bytes

From: 192.168.30.10:57286

To: 8.8.4.4:53

Size 34 bytes

From: 192.168.30.10:138

To: 192.168.30.255:138

Size 212 bytes

From: 192.168.30.10:57289

To: 239.255.255.250:1900

Size 137 bytes

From: 192.168.30.10:57289

To: 239.255.255.250:1900

Size 137 bytes

From: 192.168.30.10:57289

To: 239.255.255.250:1900

Size 137 bytes

From: 192.168.30.10:64217

To: 8.8.4.4:53

Size 34 bytes

From: 192.168.30.10:57289

To: 239.255.255.250:1900

Size 137 bytes

From: 192.168.30.10:57289

To: 239.255.255.250:1900

Size 137 bytes

From: 192.168.30.10:57289

To: 239.255.255.250:1900

Size 137 bytes

From: 192.168.30.10:64217

To: 8.8.8.8:53

Size 34 bytes

From: 192.168.30.10:64217

To: 8.8.4.4:53

Size 34 bytes

From: 192.168.30.10:57289

To: 239.255.255.250:1900

Size 137 bytes

From: 192.168.30.10:57289

To: 239.255.255.250:1900

Size 137 bytes

From: 192.168.30.10:64217

To: 8.8.8.8:53

Size 34 bytes

From: 192.168.30.10:64217

To: 8.8.4.4:53

Size 34 bytes

From: 192.168.30.10:64217

To: 8.8.8.8:53

Size 34 bytes

From: 192.168.30.10:64217

To: 8.8.4.4:53

Size 34 bytes

List of DNS queries and responses.

DNS Query

From: 192.168.30.10:50843

To: 8.8.4.4:53

Type/name

A www.bing.com

From: 192.168.30.10:50843

To: 8.8.8.8:53

Type/name

A www.bing.com

From: 192.168.30.10:50843

To: 8.8.4.4:53

Type/name

A www.bing.com

From: 192.168.30.10:50843

To: 8.8.8.8:53

Type/name

A www.bing.com

From: 192.168.30.10:50843

To: 8.8.4.4:53

Type/name

A www.bing.com

From: 192.168.30.10:59518

To: 8.8.8.8:53

Type/name

A dns.msftncsi.com

From: 192.168.30.10:59518

To: 8.8.4.4:53

Type/name

A dns.msftncsi.com

From: 192.168.30.10:59518

To: 8.8.4.4:53

Type/name

A dns.msftncsi.com

From: 192.168.30.10:59518

To: 8.8.8.8:53

Type/name

A dns.msftncsi.com

From: 192.168.30.10:59518

To: 8.8.4.4:53

Type/name

A dns.msftncsi.com

From: 192.168.30.10:59518

To: 8.8.8.8:53

Type/name

A dns.msftncsi.com

From: 192.168.30.10:59518

To: 8.8.4.4:53

Type/name

A dns.msftncsi.com

From: 192.168.30.10:57286

To: 8.8.8.8:53

Type/name

A dns.msftncsi.com

From: 192.168.30.10:57286

To: 8.8.4.4:53

Type/name

A dns.msftncsi.com

From: 192.168.30.10:57286

To: 8.8.4.4:53

Type/name

A dns.msftncsi.com

From: 192.168.30.10:57286

To: 8.8.8.8:53

Type/name

A dns.msftncsi.com

From: 192.168.30.10:57286

To: 8.8.4.4:53

Type/name

A dns.msftncsi.com

From: 192.168.30.10:57286

To: 8.8.8.8:53

Type/name

A dns.msftncsi.com

From: 192.168.30.10:57286

To: 8.8.4.4:53

Type/name

A dns.msftncsi.com

From: 192.168.30.10:64217

To: 8.8.4.4:53

Type/name

A fs.microsoft.com

From: 192.168.30.10:64217

To: 8.8.8.8:53

Type/name

A fs.microsoft.com

From: 192.168.30.10:64217

To: 8.8.4.4:53

Type/name

A fs.microsoft.com

From: 192.168.30.10:64217

To: 8.8.8.8:53

Type/name

A fs.microsoft.com

From: 192.168.30.10:64217

To: 8.8.4.4:53

Type/name

A fs.microsoft.com

From: 192.168.30.10:64217

To: 8.8.8.8:53

Type/name

A fs.microsoft.com

From: 192.168.30.10:64217

To: 8.8.4.4:53

Type/name

A fs.microsoft.com

Name	win10vm_192.168.30.20
IP	192.168.30.10
Platform	windows
OS Version	10
Machinery name	qemu
Tags	vcredist browser_edge dotnet

Task report

Task

20240609-RN6BY1_1 Reported

Signatures

Processes

Screenshots

Machine information

Task settings

Network analysis

/4 results

DNS Query

DNS Response

Command
Route