analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Pay slip.mht

Full analysis: https://app.any.run/tasks/04e0f98c-7348-436b-9db1-d786fbec9425
Verdict: Malicious activity
Analysis date: March 22, 2019, 01:22:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF, CR line terminators
MD5:

21A207995F80F95F717D74361B266090

SHA1:

5D03889A07816BDDB2E40437935746B8C802A021

SHA256:

23DAA64BB64553555FAC725EEF4B6103875C1E3FE8CC5FC2DE71183EA5A81476

SSDEEP:

6:4Q0kJQQ8a0NNEXW0Yfcvj3VTfCQ9MfS2yKiVOlAscSL7Wrn7f:4Q0AQQYf2j3VTr9eStKggWX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • WScript.exe (PID: 2384)
      • WScript.exe (PID: 3052)
      • javaw.exe (PID: 2732)
      • WScript.exe (PID: 3904)
      • javaw.exe (PID: 2436)
      • WScript.exe (PID: 2688)

    • Uses Task Scheduler to run other applications

      • WScript.exe (PID: 2384)
      • WScript.exe (PID: 2688)

    • Writes to a start menu file

      • WScript.exe (PID: 2384)
      • WScript.exe (PID: 2688)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2876)
      • schtasks.exe (PID: 1180)

  • SUSPICIOUS

    • Creates files in the user directory

      • WScript.exe (PID: 2252)
      • WScript.exe (PID: 3052)
      • javaw.exe (PID: 2732)
      • WScript.exe (PID: 2384)
      • WScript.exe (PID: 3904)
      • WScript.exe (PID: 4000)
      • javaw.exe (PID: 2436)

    • Application launched itself

      • WScript.exe (PID: 2252)
      • WScript.exe (PID: 3052)
      • javaw.exe (PID: 2732)
      • WScript.exe (PID: 4000)
      • WScript.exe (PID: 3904)
      • javaw.exe (PID: 2436)

    • Executes JAVA applets

      • WScript.exe (PID: 2252)
      • WScript.exe (PID: 3052)
      • javaw.exe (PID: 2732)
      • WScript.exe (PID: 4000)
      • WScript.exe (PID: 3904)
      • javaw.exe (PID: 2436)

    • Executes scripts

      • WScript.exe (PID: 2252)
      • WScript.exe (PID: 3052)
      • WScript.exe (PID: 3904)
      • WScript.exe (PID: 4000)

    • Connects to unusual port

      • WScript.exe (PID: 2384)
      • javaw.exe (PID: 948)
      • javaw.exe (PID: 1528)
      • WScript.exe (PID: 2688)

  • INFO

    • Reads internet explorer settings

      • iexplore.exe (PID: 2640)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2640)
      • iexplore.exe (PID: 516)
      • iexplore.exe (PID: 2180)

    • Reads Microsoft Office registry keys

      • iexplore.exe (PID: 516)

    • Changes internet zones settings

      • iexplore.exe (PID: 516)

    • Application launched itself

      • iexplore.exe (PID: 516)

    • Creates files in the user directory

      • iexplore.exe (PID: 2180)

    • Changes settings of System certificates

      • iexplore.exe (PID: 516)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 516)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 516)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
18
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe no specs iexplore.exe winrar.exe no specs wscript.exe no specs wscript.exe javaw.exe no specs wscript.exe javaw.exe schtasks.exe no specs javaw.exe wscript.exe no specs wscript.exe javaw.exe no specs wscript.exe javaw.exe schtasks.exe no specs javaw.exe

Process information

PID
CMD
Path
Indicators
Parent process
516"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\Pay slip.mhtC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2640"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:516 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2180"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:516 CREDAT:137473C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2636"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PM2354IV\pay%20slip.jar[1].gz"C:\Program Files\WinRAR\WinRAR.exe—iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.60.0
2252"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\pay slip.jar.js" C:\Windows\System32\WScript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3052"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\lqeHTATBrH.js" C:\Windows\System32\WScript.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3428"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Roaming\wuimwxtnyg.txt"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe—WScript.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
1
Version:
8.0.920.14
2384"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\IyFfaseYOW.js" C:\Windows\System32\WScript.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
2732"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Roaming\pmvwdwu.txt"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe
WScript.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
2876"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 30 /tn Skype /tr "C:\Users\admin\AppData\Roaming\IyFfaseYOW.jsC:\Windows\System32\schtasks.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
3 019
Read events
2 861
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
8
Text files
24
Unknown types
5

Dropped files

PID
Process
Filename
Type
516iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFF0BC9463E9178DB4.TMP —
MD5:—
SHA256:—
516iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico —
MD5:—
SHA256:—
516iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2636WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2636.32291\pay slip.jar.js —
MD5:—
SHA256:—
2180iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:F147B1620C11C3A8F34F2BF429D39042
SHA256:2A7DE9417536913620F2BB2C7C6D2FF56A9A76A8C1B86FAFD9C7489AC2D83D64
2640iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019032220190323\index.datdat
MD5:D5132A041F89A0BFD4C2359C2A4441D4
SHA256:0A1574AF81E691DD8428B0E331CA8C32ADEEC4172B58C2496933C41D42FAA338
2640iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\wbk9535.tmptext
MD5:DDFD89DD3FFD8356D9AF65EBA2DB83D6
SHA256:EF5E5807EE243CE3DF1433A80AD335329A522D3A497751DF87C527DDB31D9114
3052WScript.exeC:\Users\admin\AppData\Roaming\IyFfaseYOW.jstext
MD5:9AD074E4B977D42B16BEA24A940FFD32
SHA256:077D7FE9434715F0C9E979BC4B9D347A3D07A3CBEC8BE282DC0F9C2D0C52BBA1
2640iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\wbk934F.tmptext
MD5:DDFD89DD3FFD8356D9AF65EBA2DB83D6
SHA256:EF5E5807EE243CE3DF1433A80AD335329A522D3A497751DF87C527DDB31D9114
2252WScript.exeC:\Users\admin\AppData\Roaming\wuimwxtnyg.txtcompressed
MD5:8A33715D698136B17FEF4E4DC8EE1DEA
SHA256:C5002C92663A9BE024907AC9C424478D5954B6A40EE60EA69FCAB37F44EB9438
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
40
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
516
iexplore.exe
GET
200
13.107.21.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2180
iexplore.exe
198.50.154.4:443
frescosybuenos.com
OVH SAS
US
unknown
2384
WScript.exe
41.217.38.155:7755
unknownsoft.hopto.org
Spectranet
NG
unknown
516
iexplore.exe
13.107.21.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2688
WScript.exe
41.217.38.155:7755
unknownsoft.hopto.org
Spectranet
NG
unknown
516
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
948
javaw.exe
41.217.38.155:7744
unknownsoft.hopto.org
Spectranet
NG
unknown
1528
javaw.exe
41.217.38.155:7744
unknownsoft.hopto.org
Spectranet
NG
unknown

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
frescosybuenos.com
  • 198.50.154.4
unknown
unknownsoft.hopto.org
  • 41.217.38.155
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Pay slip.mht