File name:

Aimmy.zip

Full analysis: https://app.any.run/tasks/bb02fc1e-33ae-4556-abb8-41432c90db0e
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 03, 2024, 15:33:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
smartloader
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

41FBF9458EB925420B35420DAB4772B5

SHA1:

4CB2235630ADB9C8B18E53260A706B7C7502B30F

SHA256:

17AE0E2E2E6EAE2846B69E4AC7CF730091DD0D9990FE2D6776BB05F42D1EEF82

SSDEEP:

24576:0A4XfalxYBNoskVSSmGSJFN/qS7r78pTLDdhAgKJ:0A4Xyl2BNoskVSWSJFN/qS7XeTLDdhnO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 4008)

    • Connects to the CnC server

      • AimmyLauncher.exe (PID: 1112)

    • SMARTLOADER has been detected (SURICATA)

      • AimmyLauncher.exe (PID: 1112)

  • SUSPICIOUS

    • Reads the Internet Settings

      • cmd.exe (PID: 3996)
      • wscript.exe (PID: 1348)
      • AimmyLauncher.exe (PID: 1112)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 3996)
      • cmd.exe (PID: 2000)

    • The process executes VB scripts

      • cmd.exe (PID: 3996)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 1348)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 1348)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 1348)

    • Reads settings of System Certificates

      • AimmyLauncher.exe (PID: 1112)

    • Connects to the server without a host name

      • AimmyLauncher.exe (PID: 1112)

    • Reads security settings of Internet Explorer

      • AimmyLauncher.exe (PID: 1112)

    • Checks for external IP

      • AimmyLauncher.exe (PID: 1112)

    • Checks Windows Trust Settings

      • AimmyLauncher.exe (PID: 1112)

  • INFO

    • Manual execution by a user

      • cmd.exe (PID: 3996)
      • wmpnscfg.exe (PID: 2424)

    • Checks supported languages

      • AimmyLauncher.exe (PID: 1112)
      • wmpnscfg.exe (PID: 2424)

    • Reads the computer name

      • wmpnscfg.exe (PID: 2424)
      • AimmyLauncher.exe (PID: 1112)

    • Checks proxy server information

      • AimmyLauncher.exe (PID: 1112)

    • Reads the machine GUID from the registry

      • AimmyLauncher.exe (PID: 1112)

    • Reads the software policy settings

      • AimmyLauncher.exe (PID: 1112)

    • Creates files or folders in the user directory

      • AimmyLauncher.exe (PID: 1112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:02:01 18:22:14
ZipCRC: 0x21753baa
ZipCompressedSize: 317
ZipUncompressedSize: 547
ZipFileName: Aimmy.bat
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs cmd.exe no specs cacls.exe no specs wscript.exe no specs cmd.exe cacls.exe no specs #SMARTLOADER aimmylauncher.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1112AimmyLauncher.exe dataC:\Users\admin\Desktop\AimmyLauncher.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\aimmylauncher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\lua51.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
1348"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\getadmin.vbs" C:\Windows\System32\wscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2000"C:\Windows\System32\cmd.exe" /c C:\Users\admin\Desktop\Aimmy.bat C:\Windows\System32\cmd.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2424"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2432"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"C:\Windows\System32\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Control ACLs Program
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2908"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"C:\Windows\System32\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Control ACLs Program
Exit code:
5
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3996C:\Windows\system32\cmd.exe /c ""C:\Users\admin\Desktop\Aimmy.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
4008"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Aimmy.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
13 540
Read events
13 436
Write events
92
Delete events
12

Modification events

(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(4008) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Aimmy.zip
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4008) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
3
Suspicious files
2
Text files
3
Unknown types
5

Dropped files

PID
Process
Filename
Type
4008WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4008.38642\Aimmy.battext
MD5:—
SHA256:—
4008WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4008.38642\AimmyLauncher.exeexecutable
MD5:—
SHA256:—
4008WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4008.38642\databinary
MD5:—
SHA256:—
4008WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4008.38642\lua51.dllexecutable
MD5:—
SHA256:—
4008WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4008.38642\README.txttext
MD5:—
SHA256:—
3996cmd.exeC:\Users\admin\AppData\Local\Temp\getadmin.vbstext
MD5:—
SHA256:—
1112AimmyLauncher.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\json[1].jsonbinary
MD5:—
SHA256:—
1112AimmyLauncher.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
1112AimmyLauncher.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:—
SHA256:—
1112AimmyLauncher.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
16
DNS requests
6
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1112
AimmyLauncher.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/?fields=query,status,countryCode,city,timezone
unknown
—
—
unknown
1112
AimmyLauncher.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
1112
AimmyLauncher.exe
PUT
—
80.66.89.43:80
http://80.66.89.43/loader/screen/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms
unknown
—
—
unknown
1112
AimmyLauncher.exe
GET
304
199.232.210.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?140959807b46f2ee
unknown
—
—
unknown
1112
AimmyLauncher.exe
PUT
—
147.45.67.43:80
http://147.45.67.43/loader/screen/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms
unknown
—
—
unknown
1080
svchost.exe
GET
200
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?89bca2e7018c82c0
unknown
—
—
unknown
1112
AimmyLauncher.exe
PUT
—
147.45.67.46:80
http://147.45.67.46/loader/screen/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms
unknown
—
—
unknown
1112
AimmyLauncher.exe
PUT
—
147.45.67.45:80
http://147.45.67.45/loader/screen/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms
unknown
—
—
unknown
1112
AimmyLauncher.exe
PUT
—
147.45.67.44:80
http://147.45.67.44/loader/screen/OWYsN2YsN2YsYTAsOWUsODYsOGMsOTYsNjQsN2Ms
unknown
—
—
unknown
1112
AimmyLauncher.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1112
AimmyLauncher.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
1112
AimmyLauncher.exe
72.247.166.29:443
www.microsoft.com
AKAMAI-AS
FR
unknown
1112
AimmyLauncher.exe
199.232.210.172:80
ctldl.windowsupdate.com
FASTLY
US
unknown
1112
AimmyLauncher.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1112
AimmyLauncher.exe
80.66.89.43:80
—
Megacom-it LLC
RU
unknown
1112
AimmyLauncher.exe
147.45.67.43:80
—
OOO FREEnet Group
RU
unknown
1080
svchost.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
unknown

DNS requests

Domain
IP
Reputation
ip-api.com
  • 208.95.112.1
shared
www.microsoft.com
  • 72.247.166.29
whitelisted
ctldl.windowsupdate.com
  • 199.232.210.172
  • 199.232.214.172
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
pastebin.com
  • 104.20.67.143
  • 172.67.34.170
  • 104.20.68.143
shared

Threats

PID
Process
Class
Message
1112
AimmyLauncher.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
1112
AimmyLauncher.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
1112
AimmyLauncher.exe
A Network Trojan was detected
ET MALWARE SmartLoader CnC Exfil (screen.bmp)
1112
AimmyLauncher.exe
A Network Trojan was detected
LOADER [ANY.RUN] SmartLoader Check-in
—
—
A Network Trojan was detected
ET MALWARE SmartLoader CnC Exfil (screen.bmp)
—
—
A Network Trojan was detected
LOADER [ANY.RUN] SmartLoader Check-in
—
—
A Network Trojan was detected
ET MALWARE SmartLoader CnC Exfil (screen.bmp)
—
—
A Network Trojan was detected
LOADER [ANY.RUN] SmartLoader Check-in
—
—
A Network Trojan was detected
ET MALWARE SmartLoader CnC Exfil (screen.bmp)
—
—
A Network Trojan was detected
LOADER [ANY.RUN] SmartLoader Check-in
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Aimmy.zip