analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

ural.rar

Full analysis: https://app.any.run/tasks/30bf483f-6b4a-4b39-a3ff-6b00fb0e98d8
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: March 14, 2019, 16:42:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
troldesh
shade
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

9662490BED0F6D4D41B754C5C55D5C03

SHA1:

5A9A7FEBCE5A4E39552899B6F97FF4EE6B703440

SHA256:

1EBC613657BE6023853505804AF4BEF483C168BF6E9F4E323ADAF645E817F8F4

SSDEEP:

48:+KPKrEkvg2QCSTh8PP1PlZiAUm9PkTWdvZxqr+3SPkKRA/XHcLsZE1:+0ko21rPP1PvIsMydvZ4r+3SPQ/XQs8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes settings of System certificates

      • WScript.exe (PID: 2992)
      • WScript.exe (PID: 3192)
      • WScript.exe (PID: 2284)

    • Application was dropped or rewritten from another process

      • rad81406.tmp (PID: 3940)
      • radABF84.tmp (PID: 2696)
      • radC4423.tmp (PID: 3552)

    • Changes the autorun value in the registry

      • radABF84.tmp (PID: 2696)

    • TROLDESH was detected

      • radABF84.tmp (PID: 2696)

  • SUSPICIOUS

    • Adds / modifies Windows certificates

      • WScript.exe (PID: 2992)
      • WScript.exe (PID: 3192)
      • WScript.exe (PID: 2284)

    • Executes scripts

      • WinRAR.exe (PID: 2944)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2900)
      • cmd.exe (PID: 3656)
      • cmd.exe (PID: 2708)

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 3192)
      • WScript.exe (PID: 2992)
      • WScript.exe (PID: 2284)

    • Executable content was dropped or overwritten

      • WScript.exe (PID: 3192)
      • WScript.exe (PID: 2992)
      • radABF84.tmp (PID: 2696)
      • WScript.exe (PID: 2284)

    • Creates files in the program directory

      • radABF84.tmp (PID: 2696)

    • Connects to unusual port

      • radABF84.tmp (PID: 2696)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • radABF84.tmp (PID: 2696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
10
Malicious processes
6
Suspicious processes
4

Behavior graph

Click at the process to see the details
start winrar.exe no specs wscript.exe wscript.exe cmd.exe no specs #TROLDESH radabf84.tmp cmd.exe no specs rad81406.tmp wscript.exe cmd.exe no specs radc4423.tmp

Process information

PID
CMD
Path
Indicators
Parent process
2944"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\ural.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2992"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb2944.26697\Подробности заказа ОАО Ак Уральские авиалинии.jse" C:\Windows\System32\WScript.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3192"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb2944.27653\Подробности заказа ОАО Ак Уральские авиалинии.jse" C:\Windows\System32\WScript.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3656"C:\Windows\System32\cmd.exe" /c C:\Users\admin\AppData\Local\Temp\radABF84.tmpC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2696C:\Users\admin\AppData\Local\Temp\radABF84.tmpC:\Users\admin\AppData\Local\Temp\radABF84.tmp
cmd.exe
User:
admin
Company:
Burnaware
Integrity Level:
MEDIUM
Description:
Verify Disc
Version:
8.3.0.0
2900"C:\Windows\System32\cmd.exe" /c C:\Users\admin\AppData\Local\Temp\rad81406.tmpC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3940C:\Users\admin\AppData\Local\Temp\rad81406.tmpC:\Users\admin\AppData\Local\Temp\rad81406.tmp
cmd.exe
User:
admin
Company:
Burnaware
Integrity Level:
MEDIUM
Description:
Verify Disc
Exit code:
0
Version:
8.3.0.0
2284"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\Подробности заказа ОАО Ак Уральские авиалинии.jse" C:\Windows\System32\WScript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2708"C:\Windows\System32\cmd.exe" /c C:\Users\admin\AppData\Local\Temp\radC4423.tmpC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3552C:\Users\admin\AppData\Local\Temp\radC4423.tmpC:\Users\admin\AppData\Local\Temp\radC4423.tmp
cmd.exe
User:
admin
Company:
Burnaware
Integrity Level:
MEDIUM
Description:
Verify Disc
Exit code:
0
Version:
8.3.0.0
Total events
971
Read events
884
Write events
84
Delete events
3

Modification events

(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2944) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\ural.rar
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2944) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2944) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:@C:\Windows\System32\wshext.dll,-4805
Value:
JScript Encoded Script File
Executable files
4
Suspicious files
0
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3192WScript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\gr[1].mpwq —
MD5:—
SHA256:—
2992WScript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\gr[2].mpwq —
MD5:—
SHA256:—
2696radABF84.tmpC:\Users\admin\AppData\Local\Temp\6893A5D897\state.tmp —
MD5:—
SHA256:—
2284WScript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\gr[1].mpwq —
MD5:—
SHA256:—
2696radABF84.tmpC:\Users\admin\AppData\Local\Temp\6893A5D897\unverified-microdesc-consensus.tmp —
MD5:—
SHA256:—
2944WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2944.27850\Подробности заказа ОАО Ак Уральские авиалинии.jsetext
MD5:77DA105A1F519674B4B7B770120184F6
SHA256:D6BCCA7E5D54A526ECE19C69EFFFED933C1D0889B4FE1927D36052DFD27F420A
2696radABF84.tmpC:\Users\admin\AppData\Local\Temp\6893A5~1\unverified-microdesc-consensustext
MD5:BC1444C1982DF0B73F84829282940A15
SHA256:669FE6D0FD10CBCF8C73540153900DFB9B7F36AE7D68FCFFC94D496082A839E0
2696radABF84.tmpC:\Users\admin\AppData\Local\Temp\6893A5~1\statetext
MD5:9AE6E5F71BB326C0B1DB832D9F156CF6
SHA256:37FAA6F1EAB28AC8DF05C5B10AF917C7A20692293A1B1B1A77BFB9FEDB3403DA
2992WScript.exeC:\Users\admin\AppData\Local\Temp\rad81406.tmpexecutable
MD5:1AF7977917F34666EBE224EB2372A82E
SHA256:E752CEDB247290821D88105F7EB18527EAF42BC219905A1C601EF5615F8D68C1
3192WScript.exeC:\Users\admin\AppData\Local\Temp\radABF84.tmpexecutable
MD5:1AF7977917F34666EBE224EB2372A82E
SHA256:E752CEDB247290821D88105F7EB18527EAF42BC219905A1C601EF5615F8D68C1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3192
WScript.exe
128.199.228.101:443
www.partylive22.com
Digital Ocean, Inc.
SG
unknown
2284
WScript.exe
128.199.228.101:443
www.partylive22.com
Digital Ocean, Inc.
SG
unknown
2992
WScript.exe
128.199.228.101:443
www.partylive22.com
Digital Ocean, Inc.
SG
unknown
2696
radABF84.tmp
128.31.0.39:9101
—
Massachusetts Institute of Technology
US
malicious
2696
radABF84.tmp
208.83.223.34:80
—
Applied Operations, LLC
US
malicious

DNS requests

Domain
IP
Reputation
www.partylive22.com
  • 128.199.228.101
unknown

Threats

PID
Process
Class
Message
2696
radABF84.tmp
Misc activity
ET POLICY TLS possible TOR SSL traffic
2696
radABF84.tmp
Potential Corporate Privacy Violation
POLICY [PTsecurity] TOR SSL connection
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
ural.rar