analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

f.vbs.zip

Full analysis: https://app.any.run/tasks/1d103968-ef70-46fd-8874-f629e89e88f3
Verdict: Malicious activity
Analysis date: April 25, 2019, 15:51:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

7897EE2EB7816E0780D2F33439B0B598

SHA1:

0CA8F3EA0C6A338BD8025049F6C0920362A1534E

SHA256:

1CB127AAA65C11597501F0B29BA5D83120F4580D39B1DDE6C598F92A3C800400

SSDEEP:

96:euukk821JM8ga/XnsW3znJTs+H98YftG65:mK2/gaj5s+H9vo65

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 2536)

    • Starts CertUtil for decode files

      • cmd.exe (PID: 2328)
      • cmd.exe (PID: 2096)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2916)
      • schtasks.exe (PID: 4032)

  • SUSPICIOUS

    • Creates files in the program directory

      • certutil.exe (PID: 1880)
      • certutil.exe (PID: 3508)
      • WScript.exe (PID: 2612)

    • Executes scripts

      • cmd.exe (PID: 2800)

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 2612)

    • Creates files in the user directory

      • powershell.exe (PID: 2232)
      • powershell.exe (PID: 2448)
      • powershell.exe (PID: 3180)
      • powershell.exe (PID: 2728)
      • powershell.exe (PID: 2196)
      • powershell.exe (PID: 2456)
      • powershell.exe (PID: 3396)
      • powershell.exe (PID: 3768)
      • powershell.exe (PID: 3776)
      • powershell.exe (PID: 3144)
      • powershell.exe (PID: 2592)
      • powershell.exe (PID: 3164)

    • Uses WHOAMI.EXE to obtaining logged on user information

      • powershell.exe (PID: 2232)
      • powershell.exe (PID: 2728)
      • powershell.exe (PID: 2456)
      • powershell.exe (PID: 2592)
      • powershell.exe (PID: 3396)
      • powershell.exe (PID: 3164)

    • Executes PowerShell scripts

      • wscript.exe (PID: 2792)
      • wscript.EXE (PID: 3348)
      • wscript.EXE (PID: 2636)
      • wscript.EXE (PID: 3792)
      • wscript.EXE (PID: 2116)
      • wscript.EXE (PID: 2256)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 788
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2018:12:11 18:29:17
ZipCRC: 0x795ecf25
ZipCompressedSize: 3652
ZipUncompressedSize: 9141
ZipFileName: f.vbs
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
103
Monitored processes
40
Malicious processes
3
Suspicious processes
8

Behavior graph

Click at the process to see the details
start winrar.exe no specs wscript.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs certutil.exe no specs certutil.exe no specs wscript.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs powershell.exe no specs whoami.exe no specs cmd.exe no specs cmd.exe no specs wscript.exe no specs powershell.exe no specs powershell.exe no specs whoami.exe no specs explorer.exe no specs wscript.exe no specs powershell.exe no specs powershell.exe no specs whoami.exe no specs wscript.exe no specs powershell.exe no specs powershell.exe no specs whoami.exe no specs ntvdm.exe no specs wscript.exe no specs powershell.exe no specs powershell.exe no specs whoami.exe no specs ntvdm.exe no specs wscript.exe no specs powershell.exe no specs powershell.exe no specs whoami.exe no specs wscript.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2936"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\f.vbs.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2612"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\f.vbs" C:\Windows\System32\WScript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2096"C:\Windows\System32\cmd.exe" /C certutil -f -decode C:\ProgramData\Windows\Microsoft\java\dUpdateCheckers.base C:\ProgramData\Windows\Microsoft\java\dUpdateCheckers.ps1C:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2328"C:\Windows\System32\cmd.exe" /C certutil -f -decode C:\ProgramData\Windows\Microsoft\java\hUpdateCheckers.base C:\ProgramData\Windows\Microsoft\java\hUpdateCheckers.ps1C:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2536"C:\Windows\System32\cmd.exe" /C C:\ProgramData\Windows\Microsoft\java\cUpdateCheckers.batC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2800"C:\Windows\System32\cmd.exe" /C wscript /b C:\ProgramData\Windows\Microsoft\java\GoogleUpdateschecker.vbsC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3508certutil -f -decode C:\ProgramData\Windows\Microsoft\java\dUpdateCheckers.base C:\ProgramData\Windows\Microsoft\java\dUpdateCheckers.ps1C:\Windows\system32\certutil.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CertUtil.exe
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1880certutil -f -decode C:\ProgramData\Windows\Microsoft\java\hUpdateCheckers.base C:\ProgramData\Windows\Microsoft\java\hUpdateCheckers.ps1C:\Windows\system32\certutil.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CertUtil.exe
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2792wscript /b C:\ProgramData\Windows\Microsoft\java\GoogleUpdateschecker.vbsC:\Windows\system32\wscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2916schtasks /create /F /sc minute /mo 1 /tn "\UpdateTasks\JavaUpdates" /tr "wscript /b "C:\ProgramData\Windows\Microsoft\java\GoogleUpdateschecker.vbs""C:\Windows\system32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
3 628
Read events
2 906
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
24
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
2936WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2936.3990\f.vbs —
MD5:—
SHA256:—
3180powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JCKLX7261XYB9C9I2DDJ.temp —
MD5:—
SHA256:—
2232powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Y6GQ06E3U2Q1URYD637B.temp —
MD5:—
SHA256:—
2448powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DN71IMUKBHCV6D01ZQQH.temp —
MD5:—
SHA256:—
2728powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8G8RAZEOQ23PF4U8LGHT.temp —
MD5:—
SHA256:—
2196powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\P6QKN4RYGDJRD10PA2G0.temp —
MD5:—
SHA256:—
2456powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EWRA7U9UFR9UNAS4TYIJ.temp —
MD5:—
SHA256:—
3144powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3K89VM652OKW46833C7O.temp —
MD5:—
SHA256:—
2728powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF13c0a4.TMPbinary
MD5:577399A666D12A53DD1D77A47CCDC322
SHA256:E25CB989313C9128BA4BB8F4A58F5D87516D9D3CC7F784AD126597E2D8917E95
3180powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF134866.TMPbinary
MD5:577399A666D12A53DD1D77A47CCDC322
SHA256:E25CB989313C9128BA4BB8F4A58F5D87516D9D3CC7F784AD126597E2D8917E95
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
37
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

Domain
IP
Reputation
www.mumbai-m.site
  • —
malicious
37680000D103199D3C3FB007.mumbai-m.site
  • —
unknown
414522660000D103199D3C3FB007.mumbai-m.site
  • —
unknown
555935870000D103199D3C3FB007.mumbai-m.site
  • —
unknown
2129363266900000D103199D3C3FB007.mumbai-m.site
  • —
unknown
22954893110000D103199D3C3FB007.mumbai-m.site
  • —
unknown
10353321454000D103199D3C3FB007.757365722D70635C61646D696E2A2A2A2A2A2A2A2A2A2A2A2A.mumbai-m.site
  • —
unknown
2719918344820000D103199D3C3FB007.mumbai-m.site
  • —
unknown
91129894510000D103199D3C3FB007.mumbai-m.site
  • —
unknown
38650000D103199D3C3FB007.mumbai-m.site
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
f.vbs.zip