analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

f.vbs.zip

Full analysis: https://app.any.run/tasks/ba56ec77-ee01-49a6-88fc-9d263738c87a
Verdict: Malicious activity
Analysis date: December 14, 2018, 18:47:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

7897EE2EB7816E0780D2F33439B0B598

SHA1:

0CA8F3EA0C6A338BD8025049F6C0920362A1534E

SHA256:

1CB127AAA65C11597501F0B29BA5D83120F4580D39B1DDE6C598F92A3C800400

SSDEEP:

96:euukk821JM8ga/XnsW3znJTs+H98YftG65:mK2/gaj5s+H9vo65

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Starts CertUtil for decode files

      • cmd.exe (PID: 3916)
      • cmd.exe (PID: 4080)
    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 2260)
    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3640)
      • schtasks.exe (PID: 2668)
  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 2776)
    • Executes scripts

      • WinRAR.exe (PID: 2936)
      • cmd.exe (PID: 2504)
    • Creates files in the program directory

      • certutil.exe (PID: 3420)
      • WScript.exe (PID: 2776)
      • certutil.exe (PID: 3712)
    • Creates files in the user directory

      • powershell.exe (PID: 2612)
      • powershell.exe (PID: 2436)
      • powershell.exe (PID: 2972)
      • powershell.exe (PID: 2640)
    • Executes PowerShell scripts

      • wscript.EXE (PID: 2572)
      • wscript.exe (PID: 2548)
    • Uses WHOAMI.EXE to obtaining logged on user information

      • powershell.exe (PID: 2972)
      • powershell.exe (PID: 2640)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: f.vbs
ZipUncompressedSize: 9141
ZipCompressedSize: 3652
ZipCRC: 0x795ecf25
ZipModifyDate: 2018:12:11 18:29:17
ZipCompression: Deflated
ZipBitFlag: 0x0001
ZipRequiredVersion: 788
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
61
Monitored processes
20
Malicious processes
4
Suspicious processes
4

Behavior graph

Click at the process to see the details
start winrar.exe no specs wscript.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs certutil.exe no specs certutil.exe no specs wscript.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs powershell.exe no specs whoami.exe no specs cmd.exe no specs cmd.exe no specs wscript.exe no specs powershell.exe no specs powershell.exe no specs whoami.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2936"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\f.vbs.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2776"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb2936.25191\f.vbs" C:\Windows\System32\WScript.exeWinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3916"C:\Windows\System32\cmd.exe" /C certutil -f -decode C:\ProgramData\Windows\Microsoft\java\dUpdateCheckers.base C:\ProgramData\Windows\Microsoft\java\dUpdateCheckers.ps1C:\Windows\System32\cmd.exeWScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
4080"C:\Windows\System32\cmd.exe" /C certutil -f -decode C:\ProgramData\Windows\Microsoft\java\hUpdateCheckers.base C:\ProgramData\Windows\Microsoft\java\hUpdateCheckers.ps1C:\Windows\System32\cmd.exeWScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2260"C:\Windows\System32\cmd.exe" /C C:\ProgramData\Windows\Microsoft\java\cUpdateCheckers.batC:\Windows\System32\cmd.exeWScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2504"C:\Windows\System32\cmd.exe" /C wscript /b C:\ProgramData\Windows\Microsoft\java\GoogleUpdateschecker.vbsC:\Windows\System32\cmd.exeWScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3420certutil -f -decode C:\ProgramData\Windows\Microsoft\java\dUpdateCheckers.base C:\ProgramData\Windows\Microsoft\java\dUpdateCheckers.ps1C:\Windows\system32\certutil.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CertUtil.exe
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3712certutil -f -decode C:\ProgramData\Windows\Microsoft\java\hUpdateCheckers.base C:\ProgramData\Windows\Microsoft\java\hUpdateCheckers.ps1C:\Windows\system32\certutil.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CertUtil.exe
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2548wscript /b C:\ProgramData\Windows\Microsoft\java\GoogleUpdateschecker.vbsC:\Windows\system32\wscript.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2668schtasks /create /F /sc minute /mo 1 /tn "\UpdateTasks\JavaUpdates" /tr "wscript /b "C:\ProgramData\Windows\Microsoft\java\GoogleUpdateschecker.vbs""C:\Windows\system32\schtasks.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 815
Read events
1 545
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
9
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
2612powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XYB1OBHYY4VT30LF2ITX.temp
MD5:
SHA256:
2972powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Q82ETTR0TMBFHMYT4TWO.temp
MD5:
SHA256:
2436powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\P4X5NDLLBP1WUGPW7DU3.temp
MD5:
SHA256:
2972powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF13d7b6.TMPbinary
MD5:7838696109F71BF4EF6B9ED0E4BC0F50
SHA256:D379C148FB65FAEEFC5397143AB51A7381378C6DC68EB84EE29C09652B577F57
2612powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF13d787.TMPbinary
MD5:7838696109F71BF4EF6B9ED0E4BC0F50
SHA256:D379C148FB65FAEEFC5397143AB51A7381378C6DC68EB84EE29C09652B577F57
2640powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:7838696109F71BF4EF6B9ED0E4BC0F50
SHA256:D379C148FB65FAEEFC5397143AB51A7381378C6DC68EB84EE29C09652B577F57
2640powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UDDDKVQX26B7JOJP1JZG.tempbinary
MD5:7838696109F71BF4EF6B9ED0E4BC0F50
SHA256:D379C148FB65FAEEFC5397143AB51A7381378C6DC68EB84EE29C09652B577F57
2436powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF143a67.TMPbinary
MD5:7838696109F71BF4EF6B9ED0E4BC0F50
SHA256:D379C148FB65FAEEFC5397143AB51A7381378C6DC68EB84EE29C09652B577F57
2612powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:7838696109F71BF4EF6B9ED0E4BC0F50
SHA256:D379C148FB65FAEEFC5397143AB51A7381378C6DC68EB84EE29C09652B577F57
2972powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:7838696109F71BF4EF6B9ED0E4BC0F50
SHA256:D379C148FB65FAEEFC5397143AB51A7381378C6DC68EB84EE29C09652B577F57
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
13
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

Domain
IP
Reputation
www.mumbai-m.site
malicious
74370000D103199D3C3FB007.mumbai-m.site
unknown
3080140000D103199D3C3FB007.mumbai-m.site
unknown
33437274130000D103199D3C3FB007.mumbai-m.site
unknown
782780900000D103199D3C3FB007.mumbai-m.site
unknown
66840000D103199D3C3FB007.mumbai-m.site
unknown
172711473180234000D103199D3C3FB007.757365722D70635C61646D696E2A2A2A2A2A2A2A2A2A2A2A2A.mumbai-m.site
unknown
1416115756490000D103199D3C3FB007.mumbai-m.site
unknown
1788820000D103199D3C3FB007.mumbai-m.site
unknown
6113790000D103199D3C3FB007.mumbai-m.site
unknown

Threats

No threats detected
No debug info