| File name: | 194f80dc24161881d8ce03acbe83ed8141d4e7363a1a5f84faf83c740eb4be18.bin.gz |
| Full analysis: | https://app.any.run/tasks/bcf79605-5844-476e-a272-6ed5611efb91 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | April 15, 2019, 10:34:45 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/gzip |
| File info: | gzip compressed data, max compression, from Unix |
| MD5: | 5A9C037DE235C6D8DAF0A744096E454E |
| SHA1: | 63EF771D6D87E25EF34BF89704757399202EE5F6 |
| SHA256: | 1B892A7DB2D8CAC1D8841214F54AAEA2B6D04F773DD12B927A192A87861BC73E |
| SSDEEP: | 192:DODbsXGxzS3Cyfkj1MwjhNtjAW8LpcxSqR2m:i3sWICyfkj1PN9OLpcAQ2m |
MALICIOUS
Writes to a start menu file
- powershell.exe (PID: 3188)
Connects to CnC server
- powershell.exe (PID: 3188)
JASPER was detected
- powershell.exe (PID: 3188)
SUSPICIOUS
Executes PowerShell scripts
- WScript.exe (PID: 2644)
- WScript.exe (PID: 2492)
Creates files in the user directory
- powershell.exe (PID: 3696)
- powershell.exe (PID: 3188)
- notepad++.exe (PID: 2508)
- powershell.exe (PID: 2892)
Executes application which crashes
- powershell.exe (PID: 3696)
- powershell.exe (PID: 2892)
Executes scripts
- powershell.exe (PID: 3696)
INFO
Application launched itself
- RdrCEF.exe (PID: 3556)
- AcroRd32.exe (PID: 1080)
Dropped object may contain Bitcoin addresses
- powershell.exe (PID: 3188)
- powershell.exe (PID: 3696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .z/gz/gzip | | | GZipped data (100) |
|---|
EXIF
ZIP
| Compression: | Deflated |
|---|---|
| Flags: | (none) |
| ModifyDate: | 0000:00:00 00:00:00 |
| ExtraFlags: | Maximum Compression |
| OperatingSystem: | Unix |
Total processes
52
Monitored processes
15
Malicious processes
4
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 828 | "C:\Windows\system32\ntvdm.exe" -i2 | C:\Windows\system32\ntvdm.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: NTVDM.EXE Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1080 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\AppData\Local\Temp\btxa.pdf" | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | powershell.exe | ||||||||||||
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe Acrobat Reader DC Exit code: 1 Version: 15.23.20070.215641 Modules
| |||||||||||||||
| 2088 | "C:\Windows\system32\ntvdm.exe" -i1 | C:\Windows\system32\ntvdm.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: NTVDM.EXE Exit code: 3221225477 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2140 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\AppData\Local\Temp\btxa.pdf" | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | — | AcroRd32.exe | |||||||||||
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe Acrobat Reader DC Exit code: 1 Version: 15.23.20070.215641 Modules
| |||||||||||||||
| 2184 | "C:\Program Files\Notepad++\updater\gup.exe" -v7.51 | C:\Program Files\Notepad++\updater\gup.exe | notepad++.exe | ||||||||||||
User: admin Company: Don HO don.h@free.fr Integrity Level: MEDIUM Description: GUP : a free (LGPL) Generic Updater Exit code: 0 Version: 4.1 Modules
| |||||||||||||||
| 2268 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3556.1.287076710\1373239464" --allow-no-sandbox-job /prefetch:673131151 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | — | RdrCEF.exe | |||||||||||
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe RdrCEF Exit code: 0 Version: 15.23.20053.211670 Modules
| |||||||||||||||
| 2492 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\SearchI32.js" | C:\Windows\System32\WScript.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 2508 | "C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\194f80dc24161881d8ce03acbe83ed8141d4e7363a1a5f84faf83c740eb4be18.bin.vbs" | C:\Program Files\Notepad++\notepad++.exe | explorer.exe | ||||||||||||
User: admin Company: Don HO don.h@free.fr Integrity Level: MEDIUM Description: Notepad++ : a free (GNU) source code editor Exit code: 0 Version: 7.51 Modules
| |||||||||||||||
| 2580 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\194f80dc24161881d8ce03acbe83ed8141d4e7363a1a5f84faf83c740eb4be18.bin.gz.z" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 2644 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\194f80dc24161881d8ce03acbe83ed8141d4e7363a1a5f84faf83c740eb4be18.bin.vbs" | C:\Windows\System32\WScript.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
Total events
2 127
Read events
1 874
Write events
253
Delete events
0
Modification events
| (PID) Process: | (2580) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (2580) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (2580) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2580) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\194f80dc24161881d8ce03acbe83ed8141d4e7363a1a5f84faf83c740eb4be18.bin.gz.z | |||
| (PID) Process: | (2580) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2580) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2580) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2580) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (2644) WScript.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2644) WScript.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
Executable files
0
Suspicious files
9
Text files
16
Unknown types
10
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2580 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2580.868\194f80dc24161881d8ce03acbe83ed8141d4e7363a1a5f84faf83c740eb4be18.bin.gz | — | |
MD5:— | SHA256:— | |||
| 3696 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\A156X87O3PXAHWQJRQKR.temp | — | |
MD5:— | SHA256:— | |||
| 2892 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FGXLAET2BVTAAW9A01IZ.temp | — | |
MD5:— | SHA256:— | |||
| 2892 | powershell.exe | C:\Users\admin\AppData\Local\Temp\SkypeApp64.exe | — | |
MD5:— | SHA256:— | |||
| 2088 | ntvdm.exe | C:\Users\admin\AppData\Local\Temp\scs9ED3.tmp | — | |
MD5:— | SHA256:— | |||
| 3696 | powershell.exe | C: | — | |
MD5:— | SHA256:— | |||
| 828 | ntvdm.exe | C:\Users\admin\AppData\Local\Temp\scsA049.tmp | — | |
MD5:— | SHA256:— | |||
| 828 | ntvdm.exe | C:\Users\admin\AppData\Local\Temp\scsA05A.tmp | — | |
MD5:— | SHA256:— | |||
| 3188 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OM8WGZNSGIK430IPACG5.temp | — | |
MD5:— | SHA256:— | |||
| 2140 | AcroRd32.exe | C:\Users\admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
19
DNS requests
11
Threats
6
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1080 | AcroRd32.exe | GET | 304 | 2.16.186.32:80 | http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/281_15_23_20070.zip | unknown | — | — | whitelisted |
2892 | powershell.exe | GET | 200 | 185.158.249.151:80 | http://giko.emeraldsurfscience.com/api?zjyfig | NL | text | 4 b | suspicious |
3696 | powershell.exe | GET | 200 | 185.158.249.151:80 | http://giko.emeraldsurfscience.com/api?zjyfig | NL | text | 4 b | suspicious |
2892 | powershell.exe | GET | 200 | 185.158.251.243:80 | http://irm.skofirm.net/l2.php?vid=pec6 | NL | text | 35.6 Kb | malicious |
3188 | powershell.exe | GET | 200 | 185.158.251.243:80 | http://green.dddownhole.com/cryptbody2.php | NL | text | 10.4 Kb | malicious |
3188 | powershell.exe | GET | 200 | 185.158.251.243:80 | http://green.dddownhole.com/loadercrypt_823EF8A810513A4071485C36DDAD4CC3.php | NL | text | 27.0 Kb | malicious |
3188 | powershell.exe | GET | 200 | 185.158.251.243:80 | http://green.dddownhole.com/?b=USER-PC_DELL_62f21c60&os=6.1.7601.17514&v=408.3&psver=2 | NL | text | 2 b | malicious |
1080 | AcroRd32.exe | GET | 304 | 2.16.186.32:80 | http://acroipm2.adobe.com/15/rdr/ENU/win/nooem/none/consumer/280_15_23_20070.zip | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.16.106.50:80 | http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEBPqKHBb9OztDDZjCYBhQzY%3D | unknown | der | 471 b | whitelisted |
— | — | GET | 200 | 2.16.106.50:80 | http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEAXk3DuUOKs7hZfLpqGYUOM%3D | unknown | der | 727 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3696 | powershell.exe | 185.158.251.243:80 | irm.skofirm.net | 23media GmbH | NL | suspicious |
2892 | powershell.exe | 185.158.249.151:80 | giko.emeraldsurfscience.com | easystores GmbH | NL | suspicious |
2892 | powershell.exe | 185.158.251.243:80 | irm.skofirm.net | 23media GmbH | NL | suspicious |
3696 | powershell.exe | 185.158.249.151:80 | giko.emeraldsurfscience.com | easystores GmbH | NL | suspicious |
3188 | powershell.exe | 185.158.251.243:80 | irm.skofirm.net | 23media GmbH | NL | suspicious |
1080 | AcroRd32.exe | 52.20.141.173:443 | files.acrobat.com | Amazon.com, Inc. | US | unknown |
1080 | AcroRd32.exe | 2.16.186.32:80 | acroipm2.adobe.com | Akamai International B.V. | — | whitelisted |
1080 | AcroRd32.exe | 2.18.233.74:443 | armmf.adobe.com | Akamai International B.V. | — | whitelisted |
2184 | gup.exe | 37.59.28.236:443 | notepad-plus-plus.org | OVH SAS | FR | whitelisted |
— | — | 2.16.106.50:80 | ocsp.usertrust.com | Akamai International B.V. | — | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
irm.skofirm.net |
| malicious |
giko.emeraldsurfscience.com |
| suspicious |
green.dddownhole.com |
| malicious |
files.acrobat.com |
| whitelisted |
acroipm2.adobe.com |
| whitelisted |
armmf.adobe.com |
| whitelisted |
notepad-plus-plus.org |
| whitelisted |
ocsp.usertrust.com |
| whitelisted |
dns.msftncsi.com |
| shared |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3188 | powershell.exe | A Network Trojan was detected | MALWARE [PTsecurity] Trojan-Downloader.Script.Generic (JasperLoader) |
3188 | powershell.exe | A Network Trojan was detected | MALWARE [PTsecurity] Trojan-Downloader.Script.Generic (JasperLoader) |
3696 | powershell.exe | A Network Trojan was detected | MALWARE [PTsecurity] Trojan-Downloader.Script.Generic (JasperLoader) |
2892 | powershell.exe | A Network Trojan was detected | MALWARE [PTsecurity] Trojan-Downloader.Script.Generic (JasperLoader) |
3188 | powershell.exe | A Network Trojan was detected | ET TROJAN JasperLoader CnC Checkin |
1 ETPRO signatures available at the full report
Process | Message |
|---|---|
notepad++.exe | VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
|
notepad++.exe | VerifyLibrary: certificate revocation checking is disabled
|
notepad++.exe | 42C4C5846BB675C74E2B2C90C69AB44366401093
|