| URL: | https://www.okarahub.com/wp-content/themes/lambda/vendor/leafo/scssphp/site/templates/vostok_zakaz.rar |
| Full analysis: | https://app.any.run/tasks/a8732ca1-a5cf-4821-9bca-f1a8c5b62055 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | April 25, 2019, 17:11:15 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 52DCE669DC9AC6AA9EF0D718C6CE71D9 |
| SHA1: | 5C718ED32CE47DBD096D0C9689CEDEAF5562155D |
| SHA256: | 168FC83BDFDE3E98DB3E026072EDD4208ACEF80CD939EFE3D28C151F96B10A52 |
| SSDEEP: | 3:N8DSLjSLGKiVOlAQrF3ISIAL8jgVNA9mIjEmB0cf4X:2OLjSyFVOlAkF3ajQDI70cfa |
MALICIOUS
Application was dropped or rewritten from another process
- rad298DA.tmp (PID: 1464)
Changes the autorun value in the registry
- rad298DA.tmp (PID: 1464)
Downloads executable files from the Internet
- WScript.exe (PID: 3540)
TROLDESH was detected
- rad298DA.tmp (PID: 1464)
Dropped file may contain instructions of ransomware
- rad298DA.tmp (PID: 1464)
Deletes shadow copies
- rad298DA.tmp (PID: 1464)
Runs app for hidden code execution
- rad298DA.tmp (PID: 1464)
Actions looks like stealing of personal data
- rad298DA.tmp (PID: 1464)
Modifies files in Chrome extension folder
- rad298DA.tmp (PID: 1464)
SUSPICIOUS
Creates files in the user directory
- WScript.exe (PID: 3540)
- rad298DA.tmp (PID: 1464)
Creates files in the program directory
- rad298DA.tmp (PID: 1464)
Starts application with an unusual extension
- cmd.exe (PID: 2108)
- cmd.exe (PID: 3336)
Executable content was dropped or overwritten
- rad298DA.tmp (PID: 1464)
- WScript.exe (PID: 3540)
Starts CMD.EXE for commands execution
- WScript.exe (PID: 3540)
- rad298DA.tmp (PID: 1464)
Checks for external IP
- rad298DA.tmp (PID: 1464)
Creates files like Ransomware instruction
- rad298DA.tmp (PID: 1464)
INFO
Reads settings of System Certificates
- iexplore.exe (PID: 2648)
Changes internet zones settings
- iexplore.exe (PID: 2648)
Creates files in the user directory
- iexplore.exe (PID: 2104)
Changes settings of System certificates
- iexplore.exe (PID: 2648)
Adds / modifies Windows certificates
- iexplore.exe (PID: 2648)
Reads Internet Cache Settings
- iexplore.exe (PID: 2104)
Dropped object may contain URL to Tor Browser
- rad298DA.tmp (PID: 1464)
Dropped object may contain TOR URL's
- rad298DA.tmp (PID: 1464)
Dropped object may contain Bitcoin addresses
- rad298DA.tmp (PID: 1464)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
56
Monitored processes
12
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1000 | C:\Windows\system32\vssvc.exe | C:\Windows\system32\vssvc.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1464 | C:\Users\admin\AppData\Local\Temp\rad298DA.tmp | C:\Users\admin\AppData\Local\Temp\rad298DA.tmp | cmd.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 1968 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DG7GI13C\vostok_zakaz[1].rar" | C:\Program Files\WinRAR\WinRAR.exe | — | iexplore.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 2104 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2648 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2108 | "C:\Windows\System32\cmd.exe" /c C:\Users\admin\AppData\Local\Temp\rad298DA.tmp | C:\Windows\System32\cmd.exe | — | WScript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2136 | C:\Windows\system32\vssadmin.exe List Shadows | C:\Windows\system32\vssadmin.exe | — | rad298DA.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Command Line Interface for Microsoft® Volume Shadow Copy Service Exit code: 2 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2328 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\README5.txt | C:\Windows\system32\NOTEPAD.EXE | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2648 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3336 | C:\Windows\system32\cmd.exe | C:\Windows\system32\cmd.exe | — | rad298DA.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 3468 | chcp | C:\Windows\system32\chcp.com | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Change CodePage Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
1 319
Read events
1 190
Write events
125
Delete events
4
Modification events
| (PID) Process: | (2648) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
| (PID) Process: | (2648) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2648) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (2648) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones |
| Operation: | write | Name: | SecuritySafe |
Value: 1 | |||
| (PID) Process: | (2648) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (2648) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 4600000071000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000 | |||
| (PID) Process: | (2648) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active |
| Operation: | write | Name: | {2A95C6A7-677D-11E9-B63D-5254004A04AF} |
Value: 0 | |||
| (PID) Process: | (2648) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
| Operation: | write | Name: | Type |
Value: 4 | |||
| (PID) Process: | (2648) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
| Operation: | write | Name: | Count |
Value: 1 | |||
| (PID) Process: | (2648) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
| Operation: | write | Name: | Time |
Value: E30704000400190011000B001F006E00 | |||
Executable files
3
Suspicious files
1 052
Text files
59
Unknown types
43
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2648 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 2648 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 2648 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF38173C16848D9CA9.TMP | — | |
MD5:— | SHA256:— | |||
| 2648 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF16960653C72607DE.TMP | — | |
MD5:— | SHA256:— | |||
| 2648 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{2A95C6A7-677D-11E9-B63D-5254004A04AF}.dat | — | |
MD5:— | SHA256:— | |||
| 2104 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:— | SHA256:— | |||
| 2648 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019042520190426\index.dat | dat | |
MD5:— | SHA256:— | |||
| 2104 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\JavaDeployReg.log | text | |
MD5:— | SHA256:— | |||
| 1968 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb1968.35651\Подробности заказа АО Авиационная компания Восток.js | text | |
MD5:— | SHA256:— | |||
| 1464 | rad298DA.tmp | C:\Users\admin\AppData\Local\Temp\6893A5D897\state.tmp | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
19
DNS requests
7
Threats
51
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1464 | rad298DA.tmp | GET | 403 | 104.16.155.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
3540 | WScript.exe | GET | 200 | 88.99.148.81:80 | http://magicslim.ru/misc/farbtastic/1c.jpg | DE | executable | 952 Kb | suspicious |
1464 | rad298DA.tmp | GET | 403 | 104.16.155.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
1464 | rad298DA.tmp | GET | 403 | 104.16.155.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
1464 | rad298DA.tmp | GET | 403 | 104.16.155.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
1464 | rad298DA.tmp | GET | 403 | 104.16.155.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
1464 | rad298DA.tmp | GET | 403 | 104.16.155.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
1464 | rad298DA.tmp | GET | 200 | 104.18.35.131:80 | http://whatsmyip.net/ | US | html | 7.35 Kb | shared |
2648 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
1464 | rad298DA.tmp | GET | 403 | 104.16.155.36:80 | http://whatismyipaddress.com/ | US | text | 100 b | shared |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2648 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2104 | iexplore.exe | 184.95.38.139:443 | www.okarahub.com | SECURED SERVERS LLC | US | malicious |
3540 | WScript.exe | 88.99.148.81:80 | magicslim.ru | Hetzner Online GmbH | DE | suspicious |
1464 | rad298DA.tmp | 193.23.244.244:443 | — | Chaos Computer Club e.V. | DE | malicious |
1464 | rad298DA.tmp | 198.98.58.88:443 | — | FranTech Solutions | US | suspicious |
1464 | rad298DA.tmp | 104.18.35.131:80 | whatsmyip.net | Cloudflare Inc | US | shared |
1464 | rad298DA.tmp | 104.16.155.36:80 | whatismyipaddress.com | Cloudflare Inc | US | shared |
— | — | 104.16.155.36:80 | whatismyipaddress.com | Cloudflare Inc | US | shared |
1464 | rad298DA.tmp | 131.188.40.189:443 | — | Verein zur Foerderung eines Deutschen Forschungsnetzes e.V. | DE | malicious |
1464 | rad298DA.tmp | 94.130.40.100:443 | — | Hetzner Online GmbH | DE | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.bing.com |
| whitelisted |
www.okarahub.com |
| malicious |
magicslim.ru |
| suspicious |
whatismyipaddress.com |
| shared |
whatsmyip.net |
| shared |
dns.msftncsi.com |
| shared |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3540 | WScript.exe | Potential Corporate Privacy Violation | ET POLICY Suspicious EXE Download Content-Type image/jpeg |
3540 | WScript.exe | A Network Trojan was detected | ET CURRENT_EVENTS Likely Evil EXE download from MSXMLHTTP non-exe extension M2 |
3540 | WScript.exe | A Network Trojan was detected | ET TROJAN JS/WSF Downloader Dec 08 2016 M4 |
3540 | WScript.exe | Misc activity | SUSPICIOUS [PTsecurity] PE as Image Content type mismatch |
1464 | rad298DA.tmp | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 281 |
1464 | rad298DA.tmp | Potential Corporate Privacy Violation | POLICY [PTsecurity] TOR SSL connection |
1464 | rad298DA.tmp | Generic Protocol Command Decode | SURICATA STREAM excessive retransmissions |
1464 | rad298DA.tmp | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 124 |
1464 | rad298DA.tmp | Potential Corporate Privacy Violation | POLICY [PTsecurity] TOR SSL connection |
1464 | rad298DA.tmp | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 713 |
24 ETPRO signatures available at the full report